The due-diligence answers, up front.

Certifications

Cyber Essentials

HarvTech is working towards Cyber Essentials certification. [TBC: replace with certificate number and date once awarded, and state whether Cyber Essentials Plus is in scope.]

Insurance

Insurances held

• Professional indemnity insurance - [TBC: cover level and insurer]
• Public liability insurance - [TBC: cover level and insurer]
• Cyber insurance - [TBC: cover level and insurer]
• Confirmation of cover available on request before an engagement begins

Data protection

Data processing

HARVTECH LTD is registered in England & Wales and processes personal data in accordance with UK GDPR and the Data Protection Act 2018 - see the privacy policy for detail. Where an engagement involves processing personal data on a client's behalf, a data processing agreement is put in place before processing begins. A DPA is available on request.

Security management

ISO 27001 alignment

HarvTech aligns its working practices to ISO 27001 Annex A controls - access control, cryptography, operations security, supplier relationships, and incident management - proportionate to a specialist consultancy. HarvTech is not ISO 27001 certified; alignment is a working discipline, and we say so plainly rather than implying otherwise.

Client data

Handling of client data and credentials

• Client work happens in client-controlled environments wherever possible - your tenant, your repositories, your pipelines.
• No standing credentials: access via client-issued named accounts with MFA, and privileged access through PIM/just-in-time elevation where available.
• No client data, code, or configuration is reused across engagements, and none is used to train or prompt AI systems without written agreement.
• Client materials are removed from HarvTech systems at engagement end, subject to the retention obligations in the Terms of Engagement.

Delivery network

Subcontractor vetting

Where delivery involves HarvTech's network of vetted senior specialists, each is engaged under written terms that mirror HarvTech's client obligations - confidentiality, data protection, and IP assignment - with identity, right-to-work, and reference checks completed before any client access. Specialists receive the minimum access an engagement requires, through the client-controlled routes above, and clients are told who is working on their engagement.