Information security policy

Protecting the confidentiality, accuracy and availability of business information.

Issue 1 · Updated 17 October 2026 · Contact: info@thinkingfreely.co.uk

Proportionate protection

This policy sets security expectations for information handled during Thinking Freely engagements. Specific controls and evidence must be agreed and checked for the systems and work involved.

Authorised access

Access should be limited to approved users and business need. Accounts should use appropriate authentication, with multi-factor authentication where available. Access should be reviewed when roles or engagements change, and credentials must not be shared.

Client evidence and confidential documents

Use agreed methods for receiving and returning confidential evidence. Check recipients before sharing information. Avoid unnecessary copies and redact personal or commercially sensitive details where they are not required. An initial consultation should not require confidential audit records.

Devices, suppliers and continuity

People handling business information should use appropriately protected and maintained devices and services. Supplier suitability, software updates, recovery arrangements and secure disposal must be considered according to risk. Do not assume that an email link or a policy page provides secure document transfer.

Report a concern

Report a suspected security issue to info@thinkingfreely.co.uk. Provide a short description and a contact method; avoid sending passwords or confidential data. Concerns should be assessed and escalated to relevant providers or affected parties as appropriate.

Website scope

The website provides service information and a direct enquiry form protected by server-side Turnstile verification. It does not provide a client document upload portal. A public policy is not evidence that a particular technical control has been implemented or independently audited.

Related information