Legal
Effective date: January 2, 2026
The most secure systems are often the simplest. We run on Google Workspace and AWS. Identity management flows through Google Workspace with enforced multi-factor authentication.
How We Think About Access
Our access principle is simple: every person should have exactly the access they need to do their job, nothing more.
Multi-factor authentication to critical platforms is mandatory for everyone. We use hardware security keys when possible, because they're the most resistant to phishing. Authenticator apps are our backup.
Contractors are background checked and given the least level of access that lets them efficiently do their job.
We review permissions regularly and revoke immediately on role changes.
Protecting Data
Data security has a few elements: knowing where your data is, controlling who can access it, and ensuring it's encrypted both in transit and at rest.
Client data is encrypted at rest using platform encryption. All communications use TLS to protect information in transit.
Our backup strategy is simple but thorough: we maintain encrypted offsite backups of critical information and test our restoration process. A backup you can't restore isn't a backup.
Payment processing runs through Stripe and our banking partners. Credit card and bank information is encrypted, stored, and processed entirely by those partners using AES-256 encryption.
Any engagement data is retained as outlined in our Information Security Policies and then securely purged.
Subprocessors
Our primary subprocessors include AWS (infrastructure), Google Workspace (collaboration), Apollo (CRM), and Notion (collaboration). We maintain data processing agreements with each.
Monitoring & Compliance
Our security posture is continuously monitored against CIS benchmarks. View our real-time compliance status and security policies at trust.adversis.io.
Endpoint Security
We secure endpoints with business-grade EDR. Devices are encrypted, monitored, and can be wiped remotely.
Incident Response
Security incidents are inevitable. What matters is how quickly you detect them and how effectively you respond. We notify affected clients of confirmed data breaches within 72 hours.
- Detect quickly through automated monitoring
- Contain immediately to prevent spread
- Investigate thoroughly to understand scope
- Fix the root cause, not just the symptoms
- Learn from each incident to prevent recurrence
Common Questions
How do you handle client data?
We treat client data like our own crown jewels. Everything is encrypted, access is logged, and we delete it when it's no longer needed. We don't keep data around "just in case."
What happens when something goes wrong?
We focus on two things: fixing the immediate problem and preventing it from happening again. We communicate clearly with affected clients throughout the process.
How do you stay current with security threats?
Through a combination of human expertise, automated tools, and threat intelligence feeds. But more importantly, we focus on getting the basics right.
How do you handle security updates?
Infrastructure is patched automatically. Everything else follows a regular schedule—high-priority issues within 72 hours, standard updates within two weeks.
Will you sign our security questionnaire, DPA, or vendor agreement?
Yes. We're familiar with enterprise security reviews and can work with your standard agreements. Reach out and we'll coordinate.
Do you hold SOC 2 or ISO 27001 certification?
As a boutique consulting firm, we don't currently maintain formal SOC 2 or ISO 27001 certification. Our security posture is continuously monitored against CIS benchmarks at trust.adversis.io, and we maintain self-attestations of SOC 2 Security and Confidentiality Trust Services Criteria. We're happy to complete your security questionnaire or coordinate a custom review.
Reporting Security Issues
If you find a security issue, email security@adversis.io. We take all reports seriously and respond quickly. We do not maintain a bug bounty program at this time.
