Security & Compliance
Built for organizations where security review is part of the deal. Here is how we approach security in our engagements — and how this website itself handles data.
Effective 22 September 2026.
How we work in your environment
- Data stays in your environment. Our default is to work inside your infrastructure — your servers, your Azure tenant, your VPN — rather than moving data out.
- Least-privilege access. We request the minimum access needed, through your identity systems (Azure AD / Entra), and support MFA and audited accounts.
- Business Associate Agreements. Where an engagement involves access to protected health information, we execute a BAA before that access begins.
- Audit-aware engineering. Integrations and automations are designed with minimum-necessary data handling and audit trails in mind.
- Documentation & handoff. Access lists, credentials handling, and system documentation are part of every engagement's deliverables.
Infrastructure practices
- Azure-based environments with network segmentation, firewalling, and secure remote access
- Encryption in transit (TLS) and at rest for data stores we design
- Backup, recovery, and retention strategies appropriate to the data involved
- Security baselines for Microsoft 365 and identity (SSO / MFA)
- Parameterized database access and input validation as a standard, not an option
This website's own data practices
A security page should disclose what the site you are reading actually does.
- The contact form stores what you submit so we can respond. It is served over TLS, written to the database with parameterized queries, rate-limited per IP address, and capped in size. We record the submitting IP address and time solely to enforce that limit and block automated abuse.
- The AI assistant logs conversations to help us respond and improve the service. Please do not share credentials, payment details, health information, or other confidential data in the chat — it is a general-purpose assistant, not a channel for sensitive material.
- Server logs record ordinary request information such as IP address, timestamp, requested URL and browser user-agent.
- We do not collect payment card numbers, government identifiers, or account credentials through this website, and you should never send them to us through it.
- Details are in our Privacy Policy.
Reporting a vulnerability
If you believe you have found a security issue in this site or in something we built, email info@ithcc.com with enough detail to reproduce it. Please give us a reasonable opportunity to address it before disclosing it publicly, and do not access or modify data that is not yours while investigating.
Questions?
Security reviews and vendor questionnaires are a normal part of the work — we are glad to walk your security team through our practices. Contact us.
See also our Privacy Policy and Terms of Use.
Want to talk to a person?
Tell us what you are trying to build, study, improve or automate.