Information Security Policy

This policy applies to all EXCO employees, contractors and placed engineers, and to all systems, devices and client environments they use or access.

• Access to client systems and data is granted on a least-privilege, need-to-know basis.
• Multi-factor authentication is used wherever supported.
• Access is reviewed regularly and removed promptly when no longer required.

• We access only the data required for the agreed work.
• Where possible, we work inside the client's own environment rather than copying data out.
• Sensitive data is encrypted in transit and at rest.
• Client data is returned or securely deleted at the end of an engagement.
• Confidentiality agreements are signed as standard.

Code is version-controlled, peer-reviewed and kept free of credentials. Secrets are stored in dedicated secret managers, not in code or documents.

Everyone working for EXCO agrees to confidentiality obligations and receives guidance on security practices, including phishing awareness and secure handling of client data.

We select technology providers with recognised security practices and review the access they have to our information.

Security incidents are reported, investigated and resolved promptly. Where an incident affects client data, we notify the client without undue delay and work with them on the response.

We review this policy and our security controls regularly and as our services, clients and risks change.

If you believe you have found a security issue, email support@excods.com.