SigmatonIn every engagement
Controls built into the delivery model.
The same six controls apply whether we’re rolling out passwordless MFA, migrating an ERP, deploying an AI agent or building our own products.
minimiseThe smallest useful data set
Agents get only the data their job needs. A first conversation never requires sensitive data.
ownNamed human accountability
Every agent has a business owner, a technical owner and named reviewers for exceptions.
scopeLeast-privilege access
Dedicated credentials per agent, scoped to the job, inside environments you control.
auditEvidence your auditors can use
Every read, write and approval is logged in a form your risk and audit teams can review.
proveEvidence before scale
We measure the first release and agree what earns the next one before expanding access.
handoverA clean handover
Runbooks, an access inventory and a documented off switch before we step back.
This website
We hold our own site to the same standard.
Our contact form posts to our own endpoint, not a third-party form processor. It asks only for what we need to reply, and requests are deleted after 12 months.
- BrowserStrict Content Security Policy, no inline scripts
- FormFirst-party endpoint, bot check, size limits
- DataMinimal fields, 12-month retention
- InboxRestricted access; alerts contain no personal data
Clear boundaries
No invented badges.
We don’t claim certifications, client results or partnerships we can’t verify. Security, privacy and data-processing terms for each engagement are agreed before work begins.
- CertificationsStated only once verified
- Client resultsPublished only with client approval
- PartnersWriter AI implementation partner
- ExperienceNamed organizations are shown as experience, never as clients