Security by design. Privacy by principle.

Our commitment

JandaSec Ltd is committed to protecting the confidentiality, integrity and availability of the information entrusted to us, and to respecting the privacy rights of the people behind that information.

Security is integrated into business decisions, client delivery, technology choices, software development, supplier selection and the use of artificial intelligence. We apply risk-based judgement, minimise unnecessary data, restrict access, secure devices and services, and review whether controls continue to work as intended.

Detailed operational standards and procedures are maintained separately. This public policy explains the principles and controls that matter to clients, partners and visitors without publishing an operational blueprint of JandaSec’s internal environment.

Scope

This policy applies to JandaSec Ltd business information, client information entrusted to us, business systems, endpoints, cloud services, software-development activity, communications, suppliers and the public JandaSec website.

Client information remains subject to the relevant engagement terms, confidentiality obligations and any agreed data-processing requirements. JandaSec does not treat access to client information as permission to reuse it for unrelated purposes.

• Confidentiality

  Information is available only to authorised people and services with a legitimate need.

• Integrity

  Information, code and configuration should remain accurate, controlled and traceable.

• Availability

  Systems and information needed to operate the business should be recoverable and available when required.

• Privacy by design

  Collect less, retain less and avoid creating data stores that are not needed.

• Least privilege

  Access, integrations, AI tools and agent permissions are restricted to what is required.

• Continual improvement

  Controls are reviewed, tested and improved as threats, technology and business requirements change.

Governance and accountability

JandaSec management retains accountability for information security and privacy. Security risk is considered as part of business decisions rather than delegated solely to technology.

Security responsibilities are defined for systems and suppliers. Material changes to technology, data handling, AI use or business processes are expected to consider security and privacy before implementation.

Information-security risks, control weaknesses, incidents and material supplier changes are reviewed and acted on rather than treated as one-off compliance exercises.

What we are trying to achieve

• Protect client and JandaSec information from unauthorised access, loss or inappropriate disclosure.
• Keep critical business services and information recoverable.
• Reduce avoidable attack surface through secure configuration, patching and least privilege.
• Detect and respond to suspicious activity quickly.
• Use AI and software-development tools in a governed and transparent way.
• Maintain evidence that key controls are operating.
• Review incidents, changes and assurance results to drive continual improvement.

Risk-based security

JandaSec uses professional judgement to understand cyber and information-security risk in business context. Risk decisions consider the information involved, the technology, the likely threat, the potential business impact, dependencies on suppliers, and the strength of existing controls.

Security decisions are not reduced to a score alone. Assumptions and evidence gaps are made visible, treatments are prioritised, and material changes trigger reassessment.

Where weaknesses interact, JandaSec also considers the role each weakness could play in enabling access, amplifying compromise, increasing impact or allowing underlying problems to persist.

Privacy Notice

How we handle personal data

Who controls the data

JandaSec Ltd is the controller of personal data processed for its own business purposes. Registered company number 15481905. Registered with the UK Information Commissioner's Office (ICO), registration reference ZB761302.

Privacy requests can be made via the Contact page.

Website data

JandaSec deliberately keeps the public website simple. We do not use a marketing database, behavioural advertising or advertising analytics. We use Cloudflare Web Analytics for privacy-focused, cookie-free measurement of aggregate website use and performance.

The public site is static-first and does not expose a customer account system or application database. Infrastructure providers necessarily process limited technical information to deliver and secure the site. Depending on the service and configuration, this can include IP address, timestamp, requested URL, user agent and related request/security metadata.

Cloudflare Web Analytics provides aggregate information such as visits, page views, pages and paths visited, referring websites, approximate country, device type, browser, operating system and page-performance metrics. JandaSec uses this information to understand how the website is being used, identify technical or performance issues and improve the site.

The Cloudflare Web Analytics implementation does not use cookies or browser storage for analytics. Cloudflare states that Web Analytics does not collect or use visitors’ personal data and does not track individual users across its customers’ websites.

JandaSec does not use this information to build visitor profiles or for behavioural marketing.

Business and client contact data

When JandaSec works with clients, prospects, suppliers and partners, we may process business contact and engagement information such as name, role, organisation, business contact details, correspondence and information necessary to deliver or administer the engagement.

Client security material can be significantly more sensitive than ordinary business contact data. Access is restricted and the information is handled in accordance with the engagement, confidentiality requirements and JandaSec security controls.

Purpose and lawful basis

JandaSec processes only a limited amount of personal data in the ordinary course of running the business and delivering client engagements. This is principally professional contact information for people we work with, such as names, business email addresses, telephone numbers and job titles. JandaSec does not maintain a consumer database, undertake mass marketing or build profiles of individuals.

Data minimisation

JandaSec keeps personal data to a minimum. We hold only the information reasonably needed to run the business, deliver client engagements, meet legal or contractual obligations and protect our systems. We do not sell personal data, maintain consumer databases or use personal data for mass marketing.

Retention

Personal data is kept only for as long as it remains necessary for the purpose for which it was collected, including client delivery, contractual, legal, accounting, security and professional-record requirements. We do not retain personal data simply because it might be useful one day.

Retention decisions take account of the nature and sensitivity of the information, the client engagement and any applicable legal or contractual requirements.

International processing

Some of the technology providers JandaSec uses may process information outside the United Kingdom. Where UK data-protection law treats this as a restricted international transfer, JandaSec uses suppliers that provide appropriate contractual and technical safeguards for the information and service involved.

Automated decisions

JandaSec does not use personal data to make solely automated decisions about individuals that produce legal or similarly significant effects.

Individual rights

Depending on the circumstances, individuals may have rights over their personal data including access, correction, erasure, restriction and objection, together with data portability where applicable.

Requests can be made through the JandaSec Contact page. Individuals also have the right to raise a concern with the Information Commissioner's Office .

Cookies and external content

JandaSec does not use advertising, behavioural-profiling or analytics cookies on this website. JandaSec does use Cloudflare Web Analytics for aggregate, cookie-free website usage and performance measurement.

Where third-party embedded content is used, such as a YouTube privacy-enhanced video player on the homepage, that provider may process technical information or use browser storage in accordance with its own terms when the embed loads. Prefer the ordinary Watch on YouTube link if you do not want the embed.

The separate No Cookies page provides more detail. The No Cookies page explains the analytics implementation and the website’s cookie testing in more detail.

Identity and access

Access to JandaSec systems is granted according to business need and restricted using least-privilege principles.

Unique credentials are used for each service. Credentials and secrets are managed using approved encrypted storage. Multi-factor authentication or passwordless authentication is used wherever supported, with stronger authentication preferred for administrative, code, cloud and security services.

Access is reviewed when systems, responsibilities or supplier relationships change.

Endpoint protection and patching

JandaSec business devices are protected using Bitdefender GravityZone. The platform is used for centrally managed endpoint protection, detection and response, security monitoring and patch management across supported business devices.

Endpoint protection is configured as a managed control rather than relying on users to decide whether protection or updates should run. Security events and patch posture are reviewed and acted on as part of normal operations.

JandaSec maintains supported software, applies security updates according to risk and urgency, and monitors for vulnerabilities or configuration weaknesses that require action. Significant vulnerabilities or active exploitation can require accelerated action outside normal maintenance cycles.

Secure software development

JandaSec source code is managed in GitHub. Repository access is restricted to authorised identities and protected by strong account security. Source-code changes, dependencies, secrets and deployment configuration are treated as security-relevant assets.

JandaSec uses Aikido Security as part of its software-security control set. Aikido is used to identify security weaknesses in source code and to monitor third-party and open-source dependencies for known vulnerabilities and related supply-chain risk. Findings are reviewed in context and remediated according to risk.

JandaSec uses Cursor as an approved software-development environment and AI-assisted engineering tool. AI-generated or AI-assisted code is subject to human review. Use of an AI development tool does not transfer accountability for architecture, security, quality or release decisions to the tool.

Cursor Cloud Agents are also used as an additional review layer for regular source-code security assessments. Agent-led assessment is treated as supporting evidence rather than autonomous approval. Findings are reviewed by a human and material changes remain subject to normal development controls.

• No secrets committed to source.
• Dependencies are regularly assessed for known vulnerabilities and malware.
• Source code receives automated security analysis and additional AI-assisted review.
• Security findings are reviewed in context rather than accepted or dismissed automatically.
• Production-impacting and security-sensitive changes receive additional scrutiny.
• Deployment credentials are separated from source code.

AI use and governance

JandaSec uses an OpenAI Business workspace as an approved AI service. Business use is governed around the information being shared, the purpose of the task, human review and the permissions granted to AI-enabled capabilities.

OpenAI states that business workspace data is not used to train its models by default and that business content is encrypted in transit and at rest. JandaSec applies its own controls on top of the platform, including approved-use boundaries, security and privacy guardrails, governed custom skills and regular internal review of configuration and use.

Sensitive or client information is not placed into AI tools merely because the tool is available. Where AI agents or automated capabilities can take actions, JandaSec expects scoped permissions, logging, human authority, appropriate approvals and a clear way to stop or revoke access. AI output is treated as input to human judgement, not as an unquestioned source of truth.

Website and cloud security

The JandaSec website is hosted using AWS services and is designed to minimise attack surface. The public site is static-first and does not expose a customer account system or application database. Current hosting uses AWS Amplify in Europe (London), eu-west-2.

HTTPS and modern TLS are enforced, including TLS 1.3 and support for PQC (Post-Quantum Cryptography) key exchange. HTTP security headers restrict browser behaviour; recent SecurityHeaders.com assessments of the public site report grade A+. Public website configuration is reviewed after material changes. A narrow Content Security Policy exception exists only for visitor-activated YouTube privacy-enhanced embeds. External links that open in a new tab are configured with rel="noopener noreferrer" to prevent the destination site from gaining access to the originating JandaSec browser context and to avoid sending referrer information.

Cloudflare Web Analytics is used separately for privacy-focused visitor and performance analytics; website traffic remains hosted and protected through AWS rather than being proxied through Cloudflare.

DNS security

JandaSec uses DNSSEC for its public domain to protect the integrity and authenticity of DNS responses. JandaSec also uses protected DNS resolution on business devices and networks. Where Quad9 remains the configured resolver, encrypted DNS and malicious-domain filtering form part of the layered control set.

Secure communications

JandaSec uses Proton for core business email, calendar and protected document services. Strong account security and encryption controls are used alongside JandaSec's own access and information-handling rules.

Email domain protections include SPF, DKIM, DMARC and MTA-STS where configured, with TLS in transit where supported. Signal is used for secure business messaging where an encrypted messaging channel is appropriate. SendSafely is used when secure client file transfer is required.

Network and connection security

JandaSec uses NordVPN for secure remote connectivity and privacy protection on business devices, together with selected privacy and threat-protection features and Meshnet where there is a defined operational need. VPN use is one layer of protection rather than a substitute for secure endpoints, encrypted applications, identity controls or safe browsing.

JandaSec also uses Incogni as part of its privacy hygiene to reduce unnecessary exposure of personal information held by data brokers and related services. This is treated as a privacy-risk reduction measure, not as a guarantee that personal information cannot appear online.

Information handling

Information is handled according to sensitivity, confidentiality obligations and business impact. Client security evidence, credentials, secrets and sensitive assessment material receive stronger handling than ordinary public or administrative information.

Encryption and secrets

Business devices use encryption at rest. Services handling sensitive information are selected and configured to provide appropriate encryption in transit and at rest. Passwords, tokens, keys and certificates are treated as secrets and stored using approved encrypted mechanisms. Secrets must not be committed into source code or casually copied into collaboration or AI tools.

Security incidents

JandaSec maintains the ability to recognise, assess and respond to security incidents affecting its own business and information. Incidents are handled according to their likely impact, the information and systems involved, contractual and legal obligations, and any need to preserve evidence.

Relevant clients, suppliers, insurers, authorities or individuals are informed where notification is required or appropriate. Lessons from incidents and near misses are used to improve controls, procedures and readiness.

Resilience and recovery

JandaSec plans for the loss or disruption of important business systems rather than assuming prevention will always succeed. Critical information and services are backed up or recoverable according to their business need, and dependencies on key suppliers are considered as part of continuity planning. Recovery arrangements are reviewed and, where appropriate, tested.

Monitoring and evidence

Security controls are expected to produce evidence. JandaSec reviews relevant security events, endpoint health, patch posture, supplier changes and externally observable controls rather than relying on policy statements alone. Website performance and aggregate usage information is also reviewed where it helps identify technical issues or improve the visitor experience.

Verify, don't just trust

Security claims are more useful when they can be tested. JandaSec uses external services and independent checks where they provide useful evidence of externally observable controls, including TLS configuration, security headers, DNSSEC and email-domain protections.

A scan result is a point-in-time measurement, not a guarantee. Material website changes should be followed by fresh validation.

• SSL Labs
• SecurityHeaders.com
• NCSC email security check

Review and continual improvement

This policy and the controls behind it are reviewed at least annually and when significant changes occur, including material changes to services, suppliers, technology, legal obligations or the threat environment.

Weaknesses are tracked to action rather than treated as accepted simply because they have been documented.

Policy exceptions

Exceptions to established security requirements must have a legitimate business reason, an understood risk, an accountable decision and an appropriate review point. Temporary exceptions should not silently become permanent operating practice.

Privacy requests and security questions

Individuals can contact JandaSec to ask about personal data, exercise applicable data-protection rights or raise a privacy concern using the Contact page.

If you are unhappy with how JandaSec handles your personal data, you also have the right to complain to the UK Information Commissioner's Office .

For vulnerability reports, use the Vulnerability Disclosure page rather than general contact channels.

Security is never finished.

Technology changes, suppliers change and attackers adapt. JandaSec therefore treats security and privacy as continuing management responsibilities: minimise unnecessary exposure, protect what matters, test assumptions, respond when something changes and keep improving.