Security statement

Our approach

Security runs through both KTI businesses, from the boardroom to the rack. This statement is a general description of our practices. It is not a contract or a guarantee: commitments for client work are set out in each client’s agreement.

Certifications and audits

We list a certification or audit report here only once we hold it.

Security of this website

• All traffic is encrypted with HTTPS, enforced by HTTP Strict Transport Security.
• A Content Security Policy and other security headers limit what can run on our pages.
• Forms are protected by rate limits and bot checks.
• Enquiries are sent by email and are not stored in the website’s content system.

Monitoring and response

Cyrebro runs an independent 24/7 security operations centre, separate from the team that runs systems, and escalates to KTI. ORNA provides incident response programs, tabletop exercises, penetration testing and digital forensics.

Our internal controls

People

• Background checks where the law allows, and confidentiality agreements
• Security awareness training

Access

• Least-privilege access, reviewed regularly
• Multi-factor authentication, with named accounts and separate administrator accounts

Systems

• Endpoint protection and network segmentation
• Patching and vulnerability management on a defined schedule
• Documented change control
• Regular risk assessments

Resilience

• Off-site backups and tested disaster recovery
• Incident response plans, rehearsed before they are needed

Physical locations

We do not publish the locations of the data centres we work in. Any physical controls are covered in client agreements.

Service providers

We review the providers we rely on according to the data and systems they touch. The providers behind this website are listed in our privacy policy.

Reporting a vulnerability

If you think you have found a security issue in this website or our systems, tell us at hello@kearnstechnology.com. Please include enough detail for us to reproduce it, give us reasonable time to fix it before disclosing it, and do not access other people’s data, disrupt services or use social engineering.

If you are facing an incident

Existing clients should use their incident line or the client support link at the bottom of this page. Anyone else can reach us through the contact page.