Security Overview

We apply access controls based on the principle of least privilege, so that access to systems and data is limited to what is needed for a given role or engagement. Where we manage access to Client environments, we aim to use strong authentication and to review and remove access when it is no longer needed.

We follow recognised good practice for the cloud and infrastructure environments we work in, including network segmentation, encryption where appropriate, and configuration management suited to the engagement. The specific tools, standards, and configurations used depend on the nature of the service and the scope of the project, and on the Client's own environment and requirements.

Where we manage software development or delivery pipelines, we aim to follow secure development practices appropriate to the engagement, including code review and automated checks before changes reach production. The specific practices and tooling depend on the nature of the service and the scope of the project.

Personnel working on sensitive engagements are subject to vetting and confidentiality obligations proportionate to their role, and receive periodic security awareness training. We assess the security practices of suppliers before engaging them where relevant to an engagement.

We maintain an incident response process covering detection, containment, investigation, and notification. Where an incident affects personal data processed on a Client's behalf, we follow the breach notification commitments in our Data Processing Agreement.

If you believe you have found a security vulnerability affecting Hybytes systems or a system we manage, please report it in line with our Vulnerability Disclosure Policy.

Clients with specific security or compliance requirements, including questionnaires or audit requests, can raise them through our contact form; we are happy to discuss engagement-specific measures as part of the Statement of Work process.