This page lays out how we actually protect client environments and data — the platform stack running behind every account we manage, the industry framework we benchmark our own program against, and how we handle an incident if one ever happens. If you're evaluating us as a vendor, an auditor, or a cyber-insurance carrier, this is the page to start with.
Not opt-in add-ons. These are baseline for every environment we manage.
Datto EDR watches every endpoint, backed by Kaseya's around-the-clock security operations team — a person, not just an alert sitting in an inbox.
Multi-factor authentication is enforced on every interactive account, ours and the ones we manage. One documented exception exists: a non-interactive mail-relay service account for a client's legacy system, which can't complete an MFA challenge by design. It's on a dated plan to be retired by October 31, 2026.
Veeam backs up to Wasabi object storage that can't be altered or deleted once written, so a compromised account can't reach into your recovery point. Microsoft 365 data is backed up separately with Datto SaaS Protection, and our Data Recovery Policy requires a logged test restore every quarter.
INKY flags suspicious mail with plain-English warning banners right in Outlook, while BullPhish ID runs ongoing phishing simulations and short training your staff actually finishes.
Dark Web ID continuously scans for your company's credentials showing up where they shouldn't, so a leaked password gets caught before it gets used.
Every environment we manage is documented in IT Glue and kept current, so security configuration is a known, auditable state, not tribal knowledge in one engineer's head.
We don't just say "we take security seriously" and leave it there. Internally, and for clients who want it, we track posture against CIS Controls v8.1 — a widely recognized, vendor-neutral framework maintained by the Center for Internet Security, organized into 18 control families. It's the same framework auditors and cyber-insurance carriers already recognize, which is the point: a common language for "how secure," not just our word for it.
Know what's on the network before you can protect it.
Know what's installed and running, and catch what shouldn't be.
Classify, encrypt, and control access to sensitive data.
Harden devices and infrastructure away from risky defaults.
Every account tracked, every dormant one disabled promptly.
MFA and least-privilege access, granted and revoked deliberately.
Ongoing patching and scanning, not a once-a-year scramble.
Centralized logs, kept long enough to actually investigate something.
Filtering and hardening at the two doors attackers use most.
Behavior-based detection, not signature lists alone.
Backups that are isolated, protected, and actually restorable.
Firewalls, segmentation, and secure management of the network itself.
Watching traffic for what shouldn't be there, not just endpoints.
Your people trained to recognize what technology alone can't stop.
The vendors touching your data held to the same bar we hold ourselves to.
Secure defaults and vetted components for anything we build or deploy.
A documented plan and named owners, decided before an incident, not during one.
Periodically testing our own assumptions, not just trusting the checklist.
Where we are today: as of September 2026 we've completed a self-assessment against Implementation Group 1, the foundational safeguard set every organization should have in place. Of the 56 IG1 safeguards, 4 don't apply to us (we run no on-premises network, servers or VPN of our own). Of the 52 that do, 42 are implemented, 8 are in progress and 2 are scheduled — every open item has an owner and a target date between September and November 2026. This is a self-assessment, not an independent audit, and it's a living number: we're continuing to build out IG2 and IG3 coverage, and we're happy to walk any client, auditor or carrier through our current posture and supporting evidence directly.
Each control area above is backed by a written internal policy, effective September 3, 2026 and reviewed annually. Available for review under NDA.
SEC-01Secure Baseline Configuration StandardSEC-02Data Management, Sensitive Data Inventory & Retention PolicySEC-03Account Inventory & Password StandardSEC-04Data Recovery PolicySEC-05Incident Response PlanSEC-06Subprocessor / Service Provider InventorySEC-07Access Granting & Revocation ProcessSEC-08Vulnerability & Patch Management PolicySEC-09Audit Log Management PolicySEC-10Device & Software InventorySEC-11MFA Exception & Legacy Authentication Remediation PlanEvery environment we manage has a documented incident response process behind it, so if something does happen, we're executing a plan, not improvising one under pressure. Our written Incident Response Plan names both partners as incident responders and follows six steps:
As your managed IT provider, we necessarily have administrative access to the systems we support. We treat that access as a responsibility, not a convenience: it's used to deliver the service you're paying for — monitoring, patching, support, security — and nothing else. We don't sell client data, share it with unrelated third parties, or use it to train anything.
Prospective clients evaluating us as a vendor, current clients who want the specifics behind "we take security seriously," and auditors or cyber-insurance carriers doing vendor due diligence. Every control area on this page is backed by a written internal policy — configuration baselines, account management, data recovery, incident response, and more — available for review under NDA. If you need something in writing beyond what's here — a security questionnaire, a specific attestation, one of those policies — reach out and we'll work through it directly.
Our Subprocessor / Service Provider Inventory (policy SEC-06, effective September 3, 2026, reviewed annually and whenever a provider is adopted or retired) lists every third-party platform we rely on, both to run our own business and to deliver managed services, and what data each one holds. This is that inventory.
| Provider | Service | Data held |
|---|---|---|
| Microsoft 365 / Azure | Email, SharePoint, identity (Entra ID) | Client & business data, communications (US region) |
| Datto RMM (Kaseya) | Remote monitoring, management, patch deployment | Endpoint telemetry across firm and managed client devices |
| Datto EDR (Kaseya) | Endpoint detection & response | Security event / endpoint telemetry across firm and managed client devices |
| Datto SaaS Protection (Kaseya) | Backup for Microsoft 365 (SharePoint) | SharePoint backup copy |
| Uniview (Kaseya) | Unified backup management | Backup configuration and status across managed client backups |
| IT Glue (Kaseya) | Documentation & credential vault | Network documentation, client credentials |
| BullPhish ID (Kaseya) | Security awareness training & phishing simulation | Employee training records |
| Dark Web ID (Kaseya) | Dark web credential monitoring | Monitored domains / email addresses and any exposed credential matches |
| SaaS Alerts (Kaseya) | SaaS security monitoring | Security event data from managed client Microsoft 365 / Google Workspace tenants |
| Kaseya MDR | Managed detection & response | Security event / endpoint telemetry across managed environments |
| Datto Portal (Kaseya) | Unified management portal | Administrative / business data for platform access |
| INKY | Email security / anti-phishing | Scanned email content and metadata |
| Wasabi | Offsite cloud storage | Backup data for supported client organizations |
| Domain registrar / DNS provider | DNS hosting | DNS records only |
Contract and data-processing terms for each provider are available under NDA. We don't sell client data, share it with unrelated third parties, or use it to train anything.
CIS Controls is a practical, widely recognized framework that maps directly onto the day-to-day work of actually securing an environment, and it's what we use to benchmark both our own posture and the clients we manage. We haven't pursued a formal SOC 2 or ISO 27001 certification for our own company at this time; if your organization requires one of those specifically from a vendor, tell us and we'll talk through what that would take.
For servers, workstations and databases, Veeam runs the backup jobs and the data lands on Wasabi object storage that's immutable once written — meaning even a fully compromised admin account can't reach in and delete or alter a backup. Microsoft 365 data (SharePoint, mailboxes) is backed up separately with Datto SaaS Protection, encrypted and stored outside the tenant it protects. Backups are kept offsite from the systems they protect, so a single incident can't take out both the environment and its recovery point at once, and our Data Recovery Policy requires a logged test restore every quarter.
Yes, we do. That's a fair question for any vendor with the level of access we have — we just keep policy specifics (carrier, limits, certificate) off a public page. Reach out through Contact and we'll get you documentation directly.
Our two partners, through named, MFA-protected accounts — not a shared login, and never a subcontractor. Access to client documentation and credentials in IT Glue is limited to the same two people, every session is logged, and access to every system in our account inventory is revoked the same day anyone leaves the firm.
One, and it's documented. A single Microsoft 365 service account relays automated notification email from one client's legacy on-premises system over SMTP AUTH, a non-interactive protocol with no human present to complete an MFA challenge. No person signs into it. It's tracked as a dated remediation item, not an accepted exception: it's scheduled to move off SMTP AUTH by October 31, 2026, ahead of Microsoft's own shutdown of basic authentication in Exchange Online. The external summary of that plan is available on request.
Three years after offboarding by default, or whatever your contract specifies, then securely deleted using the native Microsoft 365 and IT Glue tools. Your documentation in IT Glue is exportable in full before that; it was always yours.
Ten items as of September 2026, all on our own two-laptop, cloud-only environment: final verification of our device and software inventory, enabling third-party application patch automation in Datto RMM, separating administrative access into dedicated admin accounts, adding DNS filtering, retiring the one MFA exception above, and confirming three modules in our training curriculum. Each has an owner and a target date between September and November 2026, and the tracker behind this page updates as they close.
Yes. We just handle these through a conversation first rather than an inbound form with no context — reach out, tell us who's asking and what it's for, and we'll take it from there.
The full detail on endpoint protection, detection and response, and email security as a standalone service.
See the service →How we help you answer a cyber-insurance renewal questionnaire or a client's vendor risk assessment.
See the service →Who we are, why clients stay, and the full platform stack behind everything we run.
Read more →Send it over and we'll work through it directly — no need to guess from this page alone.