Data handling
- All project storage is encrypted at rest (AES-256) and in transit (TLS 1.2+)
- Production credentials never leave your environment; we use scoped, time-limited access tokens
- Internal access is restricted to the project team plus the studio principal
- Two-factor authentication is required on every account that touches client data
Retention
| Data type | Retention |
|---|---|
| Working project files | 12 months post hand-off |
| Final deliverables (archive) | 7 years |
| Invoices and contracts | 7 years (UK statutory) |
| Email correspondence | 3 years |
| Production credentials | Deleted at hand-off |
Registrations
- UK GDPR registered with the Information Commissioner's Office
- Cyber Essentials certified (renewed annually)
- SOC 2 in progress (target completion Q4 2026)