How we protect
your systems and ours.

Last updated 2026-10-14. How we protect client systems during an engagement, and how to report a security issue in anything we operate.

How we work

We sell security work, so the way we run our own engagements has to stand up to the same questions we ask our clients.

• Named accounts for named people. No shared logins, no generic admin accounts
• Multi-factor authentication on every account that touches a client system
• Least privilege: access is scoped to the agreed work and reviewed during the engagement
• Access is removed when the engagement ends, and we confirm that in writing
• Company devices are encrypted, patched and centrally managed
• Work is documented, so nothing depends on one person's memory or one person's laptop

What we will never ask you for

Worth reading twice, because most successful attacks on IT providers and their clients start here.

• We will never ask for passwords, MFA codes or one-time passcodes — not by email, not by phone, not by WhatsApp, not through this website
• We will never ask you to approve an MFA prompt you did not trigger yourself
• We will never ask you to change bank details for a payment based on an email alone
• We will never ask you to install remote-access software from a link in an unexpected message

If you receive a message claiming to be from QNN Solutions or one of our companies asking for any of the above, it is not from us. Do not act on it, and tell us using a number or address you already have.

Reporting a vulnerability

If you believe you have found a security issue in this website or in something we operate, please tell us. We will not pursue legal action against anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.

How to report

• Email info@qnnsolutions.com with the subject line "Security report"
• Describe what you found and how to reproduce it
• Please do not publish the detail until we have had a chance to fix it

What not to do

• Do not access, modify or download data that is not yours
• Do not run denial-of-service tests or automated scanning that degrades the service for others
• Do not use social engineering against our staff or our clients

We aim to acknowledge reports within two working days and to tell you what we intend to do about it.

This website

Public pages are served alongside protected server-side enquiry storage and an owner-only sales desk. Security is an ongoing responsibility, not a promise that any website is invulnerable.

• HTTPS, a restricted Content Security Policy, browser permission restrictions and content-type protection
• Server-checked owner identity for enquiries, reports, approvals and integration actions; private responses are not cached
• Same-origin checks, owner-bound anti-forgery tokens, bounded input sizes, request limits and parameterized database statements
• Enquiry receipts issued only after storage is confirmed; email queueing, provider acceptance and delivery are tracked separately
• AI and email credentials remain on the server. The assistant cannot access other enquiries, execute tools or approve public content
• No advertising trackers. Optional chat processing and cookie-free measurements are explained in the privacy policy

If something goes wrong

During an engagement, our incident route and escalation contacts are agreed in writing before work starts. In practice that means:

• We tell you as soon as we know, rather than once we have a full picture
• We agree containment steps with you on the same call
• We write up what happened, what was affected and what changes to prevent a repeat

If a security issue affects information we hold about you, we will notify you and, where required, the relevant authority within the statutory timeframe.

Certifications and audit

We help clients prepare for ISO 27001 internal audits and client security questionnaires. See monitoring and audit for how that work runs.

Where a company in the group holds a certification, we will name the certificate, the scope and the issuing body on request rather than displaying a badge without context. If you need evidence for a supplier review, write to info@qnnsolutions.com and we will send what we can substantiate.