Security
Practices
Each person receives only the permissions their tasks require.
No shared logins. Every action is attributable to a named person.
Permissions mapped to roles where your systems support it.
Access to your systems is approved by you and can be revoked by you.
Multi-factor authentication enabled on every system that offers it.
Credentials are stored in a password manager, never in documents or chat.
Unique, strong passwords with defined handling rules for every team member.
Every team member is bound by confidentiality requirements before accessing client work.
A consistent checklist covering accounts, policies and security expectations.
Access revoked promptly and verified when someone leaves or changes role.
Provided where the engagement requires it, with agreed configuration standards.
Immediate removal of access when risk or a role change requires it.
A defined path to report, contain and notify you about suspected security issues.
Access lifecycle
Access needs are defined per role during solution design.
You approve access to your systems before anything is provisioned.
Individual accounts are created with MFA and least privilege.
Access is reviewed periodically and when roles change.
Access is removed promptly and confirmed at offboarding.
Transparency
Kordan does not currently hold third-party security certifications or attestations such as SOC 2 or ISO 27001, and we don’t describe our practices as compliant with frameworks we have not been audited against.
What we can do is explain exactly how we operate, answer your security questionnaire in detail, and agree specific controls in writing as part of the engagement.
Data protection
For engagements involving personal data of people in the EU or UK, appropriate contractual and data-processing arrangements can be put in place, depending on the engagement.
Some workflows, such as those involving payment card or health information, carry specific regulatory requirements. We assess these during discovery and will tell you plainly if an engagement is not a fit.
Tell us about your systems, data and access requirements, and we’ll explain how we would operate within them.
Tell us what you’re trying to build.