Agree the boundaries
Before access to client systems or confidential data, the engagement should identify the authorised activities, people, tools and information handling requirements. Where we act as a processor of personal data, the required written processing terms must be agreed.
Use approved channels and permissions. Do not place client data in public demonstrations or disclose it to a partner or tool without the appropriate authority and safeguards. The dashboards on this website contain fictional examples, not live client information.
Access and remote working
Our required approach is to limit access to what a person needs, protect accounts and devices, and remove access when it is no longer required. Client authentication and security controls must be followed. Credentials must not be shared or embedded in public files.
Remote work should take account of device protection, updates, secure connections and the privacy of the working environment. Backups, recovery and retention arrangements must be appropriate to the service and agreed responsibilities. Detailed evidence of operating controls is assessed for the relevant engagement.
Incidents and confidential reporting
Suspected loss, disclosure, compromise or unauthorised access must be raised promptly with the engagement lead or a director. The response should preserve relevant evidence, limit further harm and consider contractual and legal notification obligations.
For an initial report, email engage@eqsolutions.co.uk with a brief description and a safe contact method. Do not include passwords, sensitive records or exploit details in the first message. We will agree an appropriate way to review further information.
Supplier assurance
Clients can request relevant assurance information through engage@eqsolutions.co.uk. We will confirm the scope and available evidence for the proposed engagement. A policy statement is not a certification or an independent assurance report.
Any certification or control assessment supplied for procurement must identify the organisation, scope and current validity. Credentials held by our partners are attributed to those partners.
Further guidance
Official guidance relevant to this statement