Code of ethics

Confidentiality is not a clause in a contract

We do not publish who we work for. No names, no logos, no case studies from which a client could be guessed. Not even when it would help us sell.

The reason is not modesty. Whoever publishes whom they audit hands an attacker a map. A security consultant's client list is a list of organisations in which someone from outside is known to know the weak spots — and attempts to obtain information about a client through its supplier are not a theory.

That is why on this website you will find sectors, not companies. And we will not name even a sector where it is so small that naming it would in effect name the client.

If you need a reference for a specific engagement, ask for one. We provide it only with the client's consent, to you directly, not by publishing it.

Impartiality in audits

The same organisation may not both build a system and certify it. This is a requirement of impartiality and it applies without exception — to us and to everyone else.

Where we prepared a system, we do not certify it. We perform internal audits only where we were not the authors of the part being audited, and nobody audits their own work. If such a situation threatened to arise, we say so before the work starts and propose another solution.

Information we learn at your organisation

During an audit or an implementation we learn where an organisation has weak spots. We treat that information as we would treat the weakness itself — we do not mention it in offers, we do not use it in marketing and we do not share it within the group without a reason and without a contractual basis.

If part of the work is provided by a partner, it is a processor relationship with a contract, and the client knows about it in advance, not afterwards.

What we claim and what we do not

We can prove the figures we give. If we have no evidence, we do not give the figure — better an empty space than a figure that does not survive the first question.

We do not sell urgency that does not exist. The deadlines in the regulations are urgent enough on their own; an invented capacity shortage or an artificial cut-off date does not belong on our website.

We state the limits of our competence up front. They are on every service page and, in one place, under qualifications and memberships. What we do not know, we do not promise.