How we handle your data.
This page is maintained by Stratford Ellis to describe how we work with client data in the property and infrastructure sector. It is not an independent certification. For anything specific to your procurement, security or DPIA process, get in touch and we will work through your requirements directly.
What we do by default on every engagement.
NDAs by default.
Every engagement starts under a mutual NDA. If you have your own template, we will sign yours.
Work inside your environment where you prefer.
For sensitive engagements we work inside your tenant, VPN and tooling — no client data leaves your perimeter.
Least-privilege access.
Access is scoped to the systems and datasets the engagement needs, time-boxed, and revoked at the end.
Named team, no offshoring.
You know who is on your account. We do not offshore delivery or subcontract without your written agreement.
Secure devices and channels.
Encrypted disks, managed devices, MFA on everything, and password managers rather than shared credentials.
Clear incident reporting.
Anything that could affect your data is reported to your named contact promptly, with the facts we know at the time.
We hold up our end. You control access.
Security in a consulting engagement is a partnership. We are responsible for how we handle the data you give us — the devices, accounts, channels and processes we use. You are responsible for what access we are granted, to which systems, and for how long.
We will always work within the constraints your security team sets. If those constraints need to be tightened for a particular dataset, tell us and we will adapt — remote-only working, isolated environments, restricted exports and short-lived credentials are all options we support.
UK GDPR aligned. Case-by-case for anything more.
We are a UK company and align our data handling with UK GDPR. Where an engagement involves personal data, we will sign a Data Processing Agreement and agree the lawful basis, retention and deletion approach with you upfront.
For clients with sector-specific requirements — regulated utilities, transport, public sector, finance-adjacent work — we tailor our approach to fit. Ask us and we will walk through what we can commit to and what we cannot.
To report a security concern or ask a specific question, email security@stratfordellis.com.
Read our privacy policyFind out where your portfolio is leaking time and money.
Book a discovery call and we will map the data and systems behind your property or infrastructure business, flag the risks, and show you the fastest route to a foundation you can trust.