— Trust & security

Trust lives in the join.

We’re a consultancy, so our security story is how we vet the AI partners we recommend, contract them for you, and connect them to your systems. Here is what is in place today, what is in flight, and what is next.

Request our security pack
A hand holding a key towards a keyhole in a Sticklebrick-blue block, representing scoped, human-controlled access
— 01Assurance, stated plainly

What’s done. What’s next.

Live

Cyber Essentials Plus

Certified and renewed annually. The baseline UK assurance most FM tenders specify.

Live

UK GDPR and DPA

A standard data processing agreement is available before you sign. UK data residency by default; EU regions on request.

In progress

SOC 2

Programme under way. Ask us for the current attestation stage.

Roadmap 2027

ISO 27001

Information security management system scoped. Certification audit planned for the first half of 2027.

— 02Six pillars

How the work holds.

S—01

Encryption in transit and at rest

TLS 1.3 between components and AES-256 at rest in customer regions, with per-tenant keys. Customer-managed keys available on Enterprise.

S—02

SSO and least privilege

SAML 2.0 and OIDC single sign-on, role-based access with workspace isolation, and MFA on all administrative actions.

S—03

Every join scoped

Per-system OAuth or service-account scoping, so we only read and write fields you approve. PII and commercial data is redacted at the integration boundary.

S—04

Every action recorded

A tamper-evident audit log of reads, writes and human reviews, with one-click rollback on writes and SIEM streaming on Enterprise.

S—05

Your data is not training data

Customer data is never used to train any model, ours or a third party’s. Default retention is 30 days for debugging, configurable down to zero on Enterprise.

S—06

Incident response

A written process with a 24/7 on-call rotation, customer notification within 24 hours of a confirmed incident, and published post-mortems for P0 and P1 events.

— 03An integration, in plain English

Five steps. Human in charge.

  1. 01

    Scoped connection

    You approve which fields we can read and write, per system.

  2. 02

    Boundary redaction

    PII and commercial fields are masked before they leave your perimeter.

  3. 03

    Encrypted transport

    Outbound calls only, never callbacks into your network.

  4. 04

    Reversible writes

    Every write is logged with a reverse. High-stakes writes need human approval by default.

  5. 05

    Streamed audit

    Events are hashed into the audit log and streamed to your SIEM.

— 04Sub-processors · reviewed May 2026

Who handles what, and where.

AWS

Application hosting and primary storage

UK (eu-west-2). SOC 2, ISO 27001.

Anthropic

Foundation model inference, zero retention

EU / US. SOC 2.

OpenAI

Foundation model inference, zero retention

EU / US. SOC 2.

Datadog

Observability and performance monitoring

EU (Frankfurt). SOC 2, ISO 27001.

Stripe

Billing and invoicing

UK / EU. SOC 2, PCI DSS Level 1.

Okta

Identity and SSO

EU (Frankfurt). SOC 2, ISO 27001.

Customer data is pinned to one region per tenant: UK by default, EU on request, and never moved without your opt-in. We give 30 days’ written notice of any new sub-processor. Questions: security@sticklebrick.com

— Next step

Need our security pack before the call?

We’ll send the DPA, sub-processor list and assurance summary within one working day.

Request the pack →Start the free audit