Confidentiality Policy

1. Mutual obligation

Confidentiality obligations are mutual. Each party protects the other's confidential information with at least the care it applies to its own, and uses it only for the purposes of the engagement.

2. What is confidential

Business plans, strategy, financial information and pricing.

Technical information including source code, architecture, credentials and security posture.

Customer, supplier and employee information.

Commercial terms of the engagement between us.

Anything marked confidential, and anything a reasonable business person would understand to be confidential in context.

3. Exclusions

Information that is or becomes public without breach of an obligation; was already lawfully known to the receiving party; is independently developed without use of the disclosing party's information; or is lawfully received from a third party without restriction.

4. Our people and subcontractors

All Cyntra personnel are bound by written confidentiality obligations as a condition of employment or engagement, which survive the end of their relationship with us.

Subcontractors are bound by equivalent obligations before receiving any client information. We remain responsible for their compliance.

5. Handling and access

Access is limited to personnel who need it for the engagement, on a least-privilege basis.

Client information is stored in controlled systems with encryption and access logging, not on personal devices or consumer file-sharing services.

Production data is not used in development or test environments unless strictly necessary, and then only masked or anonymised.

Credentials are held in a managed secret vault, never in code, configuration files or chat messages.

6. Publicity and references

We will not name you as a client, describe your project, or use your logo in any public material without your prior written consent.

Case studies published on this site are anonymised by default, describing the industry and scale rather than the organisation. Where a client has consented to attribution, that consent is documented.

You may withdraw consent to a reference or case study at any time and we will remove it promptly.

7. Compelled disclosure

Where disclosure is required by law, court order or regulatory authority, we will disclose only what is required and, where lawfully permitted, notify you in advance so you may seek protective relief.

8. Return and destruction

On request at the end of an engagement, we return or securely destroy confidential information, other than copies retained in backups until their scheduled expiry or as required for legal and accounting obligations.

Retained copies remain subject to these confidentiality obligations for as long as they exist.

9. Duration

Confidentiality obligations continue for five years after the end of the engagement, and indefinitely for trade secrets and information which by its nature requires perpetual protection.