Read-only first
For an Audit or Readiness Sprint, we request Reader and Cost Management Reader roles only. We do not need broad administrative access and make no production changes during assessment work.
Security practices
Minimum access. Client-controlled identity. Written boundaries.
Security requirements are agreed before access is requested. This page describes Accepire’s current working defaults and states the limitations a security or procurement reviewer should know early.
Named, client-controlled access
For direct access, we ask the client to issue a named, time-bounded identity and apply its own MFA and conditional-access policy. Accepire does not store client credentials. Access should be revoked when the agreed evidence work ends.
Evidence-only alternative
If direct access does not fit your policy, provide agreed exports and join a focused walkthrough. We document what could not be verified through that evidence path.
Purpose limitation
We use the agreed evidence only to deliver the agreed work. We do not use client environments as demonstration material or disclose engagement details without written permission.
Retention and deletion
The engagement letter records what evidence may be retained, where it is handled, and the deletion or return date. Do not send credentials or unnecessary personal data through website forms.
Change control
Implementation work is separately scoped. Production changes follow the agreed approval, validation, access, and rollback path.
Incident notification
We notify the client within 12 hours if a confirmed security incident affects its data or environment, then follow the notification and cooperation terms in the engagement documents.
Delivery parties
Accepire does not use delivery subcontractors by default. Website providers used for analytics, forms, and scheduling are listed in the privacy notice. Any third party required for an engagement is disclosed and agreed before access.
Insurance limitation
Accepire does not currently hold professional indemnity insurance. If insurance is mandatory, we must agree an insured prime-contractor route or decline the engagement.
Contract details
Data handling, confidentiality, liability, retention, access revocation, and any data-residency requirements are confirmed in the engagement letter.