We never ask for credentials
Assessments run on screenshots, read-only exports, and interviews. We do not request passwords, admin accounts, API keys, or production access.
Security practices
You will share sensitive information with us during an engagement. Here is how we protect it.
Multi-factor authentication everywhere
Every account that touches client information, including email, file storage, and scheduling, requires MFA.
A password manager for every secret
All business credentials live in a password manager with unique, generated passwords. Nothing is stored in documents or browsers.
Encrypted storage and devices
Client files are kept in encrypted cloud storage with access limited to the engagement. Work devices use full-disk encryption and automatic screen lock.
Written policies we follow ourselves
We keep a short set of written security policies covering access, data handling, devices, and incident response, and review them at least once a year.
Clean offboarding of your data
When an engagement ends, we return or delete your evidence and working files within 30 days unless our agreement says otherwise, and confirm in writing.
This website
This site is a set of static pages with no database, no user accounts, and no advertising trackers. It is served over HTTPS with a strict content security policy. Traffic is measured with Cloudflare Web Analytics, which does not use cookies.
Contact, signup, and readiness-check forms are processed by Formspree and delivered to our business email. See the privacy notice for details.
Reporting a security issue
If you believe you have found a security problem with this site or our handling of your information, email hello@hartgateadvisory.com with "Security" in the subject line. We acknowledge reports within two business days. Our security.txt file lists the same contact.
Questions during procurement
If your team needs answers for a vendor review before signing, ask during the intro call. We will complete a reasonable security questionnaire about our practices at no cost.