Security and data handling

This page describes what we actually do. We don't hold SOC 2 or ISO 27001 certification. If you need us to follow your own security requirements, we'll review them before we sign.

Draft. Each practice below is being confirmed by the engineers, and this page has not had legal review.

Access to your systems

• Read-only access by default, granted through your SSO or identity provider wherever possible.
• Time-limited access, revoked when the engagement ends. We keep a log of who had access and when.
• Named individuals only. We never use shared accounts.
• Multi-factor authentication on every account we use for client work.

Your code and data

• No production data is copied to personal devices. We work in your environments, or on encrypted company-managed machines.
• We use anonymised or synthetic data for testing unless a data processing agreement covers real data.
• When an engagement ends, we delete working copies of your code and data and confirm it in writing.
• Load tests and any other active testing run only against environments you've authorised in writing.

AI models and confidential data

When documents can't leave your infrastructure, we can deploy open-weight models privately, or run them locally inside your environment. When you do use hosted model APIs, we'll tell you exactly which provider receives which data, and under which terms.

Personal data

Where we process personal data on your behalf, we act as your processor under a data processing agreement aligned with the UK GDPR and the EU GDPR, including the appropriate safeguards for transfers to India. [Transfer mechanism to be confirmed with legal counsel]

Report a concern

Email support@sirendesk.com. We acknowledge every report within two business days.