How we work

Written authorisation, every time

We don't touch a system until you've approved it in writing, and that approval names the specific system. The same applies during an incident. For Blue retainers we agree the authorisations you're likely to need when you sign up, so we're not waiting on paperwork at a bad moment. Anything outside that needs a new signature first.

• Which systems, accounts and data are covered
• What we may and may not do
• When we may do it
• Who signed, and why they're allowed to
• Who to call if something unexpected happens

The law: Computer Misuse Act 1990

Accessing a computer system without permission is a criminal offence in the UK. Your written authorisation is what makes our work legal, so we check that the person signing has authority over everything in scope, and take extra care with systems run by a third party.

Your data: UK GDPR

When we handle personal data for you, we're your processor under Article 28 of the UK GDPR and work under a data processing agreement. We only access what the job needs, keep it secure, and return or delete it when we're done.

Evidence that holds up

If an incident could lead to an insurance claim, a dispute or a prosecution, the way evidence was collected matters as much as what it shows. We hash everything at the point of collection, so any later change would be obvious, and log every time it's moved or accessed. We write down how each item was collected and analysed, so someone else could check the work.

No hacking back

Attacking an attacker is illegal in the UK, and the systems they use often belong to innocent people. We won't do it, even if asked. We keep the evidence and, with your agreement, report it to your local police, Report Fraud (which replaced Action Fraud) or the National Crime Agency.