Defend · At the core
Your client files and accounts.
Every layer of Defend protects the same two things: the files your clients trust you with, and the accounts that can open them.
Where we start
Attackers rarely crack a file. They sign in.
Instead of breaking a file open, they take over an account that can already open it: through a convincing email, a reused password or a former colleague’s login nobody switched off. So we protect files and accounts together: as few people as possible can open each file, and every account that can is hard to take over.
Access
Who can open a client file?
Only the people working on it.
In many firms, almost anyone can open almost anything. With us, only the people who need it.
- The team working on it can open it
- The rest of the firm can’t
- Guests only what’s shared, while it’s shared
- Admins, ours included keys in the vault, every use logged
- Leavers and the old provider removed
-
The team on it, not the whole firm
Files live where the work is organised, by matter, client or project, and access follows the people working on it.
-
Sharing outside the firm, on purpose
Clients, counterparties and the firms you work with see what you share with them, for as long as you share it. Who may share what, with whom, is decided with you and written down.
-
Leavers lose access on their last day
Joiners and leavers are scripted: new colleagues start with what their role needs, and leavers lose their access on their last day, so nothing is forgotten.
-
Access checked, not assumed
We review who can open what, so access that made sense last year doesn’t quietly stay. The result goes into your evidence file.
-
AI sees only what people may see
Before an AI assistant is switched on, we tidy permissions and sharing, so it only shows people what they’re allowed to open.
Sign-in
Who is really signing in?
A password alone opens nothing.
-
One identity per person
Every colleague has one identity in Microsoft Entra ID, granted and withdrawn in one place.
-
A second factor for everyone
Multi-factor sign-in for every account, so a stolen password on its own doesn’t get anyone in.
-
The person, the place and the device
Conditional access checks who is signing in, from where and on which device, and asks again when something doesn’t fit.
-
If an account is taken over anyway
We lock it, check what it opened and what it sent, clean up and tell you first, in plain words. Then it goes into your evidence file.
The keys
Who holds the keys to everything?
Few people, by name, and every use is logged.
-
Admin rights for few, by name
Admin roles in Microsoft Entra ID go only to the people who need them, each by name.
-
Passwords in a vault, not a spreadsheet
Admin passwords sit in a vault. Every use is logged, and only the people who need it can open it.
-
Our keys first
As your IT provider we hold the most powerful accounts in your firm. So our engineers open client files only where a task needs it, that access is on record, and everyone who can see client data is bound to confidentiality in writing.
-
The old provider’s keys, gone
When you move to us, we remove the software and access your previous provider left behind, so nobody keeps a way in.
-
And the keys stay yours
Your tenant, your files and the admin access belong to your firm. If you ever leave us, you leave with all of it, documented.
Location
Where do your files live?
Exactly where it says in writing.
-
Documented, service by service
Where Microsoft 365 and every other service keep your data is written down, so a client’s question gets a page, not a guess.
-
Sovereign hosting where a mandate needs it
Where a client or a mandate requires your data to be kept under particular rules, there are sovereign hosting options.
-
Processed for one purpose
We work under a data processing agreement and process your data only to run and protect your systems.
-
The same rules everywhere
Office, home, a site office or abroad: the same access rules everywhere, so a file is as protected on the road as at the desk.
The way back
Can you get them back?
Yes, and we’ve tested it.
-
Backed up
Backups for Microsoft 365, servers and devices: mail and files included.
-
Restored on purpose
We restore from the backups before you need them, and the date of the last test goes into your evidence file.
-
Kept as long as you have to keep them
Archives and retention planned for the years you’re bound to keep your files, with long-term archiving for email.
Evidence
Can you show it?
In one file, before anyone asks.
- Who can open what, from the last access review
- Who holds admin rights, and that their passwords sit in the vault
- How sign-in is protected: multi-factor sign-in and conditional access
- Where your data lives
- When a restore was last tested
- What happened in an incident, and what we changed
Ready for a client’s security questionnaire, your insurer or your auditor.
See the evidence fileYour sector
What your sector asks of your files.
Questions we get
Can your engineers read our client files?
They can reach what they administer, as with any IT provider. They open client files only where a task needs it, that access is on record, and everyone who can see client data is bound to confidentiality in writing.
Where exactly is our data stored?
It’s written down service by service, and you’ll find it in your evidence file. Where a client or a mandate requires your data to be kept under particular rules, there are sovereign hosting options.
What happens to our files and access if we leave 2nd wind?
They stay yours. You get the admin access, the documentation and a plan for the move, so the next provider doesn’t start from nothing.
Do you use our data for anything else?
No. We work under a data processing agreement (Art. 28 GDPR and UK GDPR) and process your data only to run and protect your systems.
Start
Who can open your client files today?
In a first call we go through who can open what in your firm, who holds the keys, and what your evidence would show today.
- No first level
- No surprises
- Pilot before you buy