Trust | Baseline Telemetry Advisory

Baseline Telemetry Advisory runs a multi-tenant delivery workspace for each client engagement. This page describes the controls that are currently enabled and the practices we follow. It is not an independent certification or audit report.

Our own certification roadmap

Baseline Telemetry Advisory holds no security certification today, and we will not imply otherwise. As a solo-founded practice that is not yet operational, we will not pursue ISO 27001 or SOC 2 before we have stable clients, revenue, and the operational evidence an auditor can review. Both certifications carry meaningful cost and time: internal readiness work, external audit fees, and ongoing monitoring. For a one-person team at launch, that cost is hard to justify unless a client contract specifically requires it.

Our immediate, non-negotiable baseline is GDPR/UK GDPR compliance, supported by the privacy notice, DPA, retention schedule, and sub-processor list on this site. Once the practice is live and revenue supports it, we will pursue certifications in this order:

ISO 27001: targeted first, because it is the strongest international signal for our EU and UK base and is respected in the US.
SOC 2 Type I: targeted after ISO 27001, as a point-in-time attestation of control design for US venture-stage SaaS buyers.
SOC 2 Type II: targeted after Type I, because it is the standard procurement signal for US enterprise buyers and requires months of operating evidence.

We are designing the ISMS once so it maps to both frameworks. Target dates will be set once the practice is live and we can evidence a full audit period. Until a certificate or attestation report is issued, everything on this page is our own statement of practice, evidenced on request rather than independently attested.

How we evidence controls as a service provider

We deliver client work in two modes: Mode A through a private workspace with structured exports, and Mode B through scoped, time-bounded access to the client's own tools. Clients may prefer Mode B, so their data may never sit in our workspace. That does not prevent us from certifying our own practice.

ISO 27001 and SOC 2 audit the security management system of the service provider, not the volume of client data stored in its own tools. Our evidence comes from our own systems and processes:

Identity, access, and device management for Baseline Telemetry Advisory staff and contractors.
Our own policies, risk register, asset register, supplier register, and audit trail.
How we access, handle, return, and delete client data in client systems.
Vulnerability management, incident response, business continuity, and change-management records.

The scope of our future certification will be the Baseline Telemetry Advisory practice and delivery systems, including how we deliver services using client-managed tooling. We will not claim a broader scope than we actually operate.

Governance documents we maintain today

The management system is in formation and already documented. We maintain a scope statement and a full Statement of Applicability covering all 93 Annex A controls, an information security policy with the supporting set (acceptable use and endpoints, cryptography and key management, supplier security, people security, physical and home working), a client data handling standard for both delivery modes, an art. 30 record of processing activities, a DPIA methodology with recorded screening decisions, transfer impact assessments for every transfer path, legitimate interests assessments, a personal data breach procedure and register, an internal risk register with an asset inventory, and the record sets for management review, internal audit, corrective action, and awareness training.

Each document has a named owner, a version, and a review date. Review is annual at minimum, and also triggered by an event: a sub-processor change, a new processing purpose or lawful basis, a change of delivery mode, an incident or near miss, a material legal change, the first client engagement, the first person engaged, a material platform change, or a change of scope. Reviews are reminded automatically at 45, 30, 15, and 3 days out and on the day, anything overdue is escalated in our weekly operations digest, and each completed review is recorded on an append-only audit trail. Clients and procurement teams can request the relevant document during a security review by emailing privacy@btadvisory.io.

What we do

We are a boutique Information Security, Cyber Risk, and GRC advisory practice. Engagements run in one of two modes: Mode A, a private delivery workspace with structured exports (PDF, XLSX, DOCX, ZIP); or Mode B, direct in-platform execution inside the client's own tools (for example Jira, Linear, Vanta, Drata, Secureframe) under scoped, time-bounded access that respects the client tool's own controls.

Shared responsibility

Baseline Telemetry Advisory is responsible for the security of the workspace we build and operate: application controls, access management, hosting configuration, and sub-processor selection.
Our clients are responsible for managing their user accounts, choosing who to invite, and the accuracy and lawfulness of the content they upload.
Our sub-processors (see /subprocessors) are responsible for the underlying infrastructure they provide.

Access and authentication

Multi-factor authentication (TOTP) is mandatory for every user account. Users without a verified factor are funnelled to enrolment on sign-in.
Passwords are screened against the Have I Been Pwned database at sign-up and on password change.
Advisor sessions are capped at four hours; clients receive a session-timeout warning before expiry.
Row-level security is enabled on every workspace table; policies scope reads and writes to the caller's tenant and role, and a blocked attempt is recorded in the audit trail rather than silently dropped.
Advisor cross-tenant access is audited and time-limited per session.

Vulnerability management

Static analysis and secret detection run automatically on every push and pull request against our source code, with a full commit-history secret sweep monthly.
Dependency and licence scanning against the lockfile runs on a roughly monthly cadence and again at every promotion to production, with cloud posture checks on the hosting configuration.
High or critical findings from dependency and infrastructure scans are surfaced on the pull request for review before merge; today that review is manual rather than an automatic branch-protection gate.
Automated backend security checks run on every deploy, covering row-level security gaps, exposed data, and misconfiguration.
Triage SLO: critical within 7 days, high within 30 days, medium within 90 days.
Scope: our scanning and monitoring tooling operates on Baseline Telemetry Advisory source code, dependencies, platform configuration, and public health endpoints. It does not process client workspace content, uploaded evidence, or tenant user data, and is therefore not listed on /subprocessors. The specific tools are recorded in our internal supplier register and can be disclosed under NDA during due diligence. Drift Watch is the one exception, described below and on /subprocessors.

Report a vulnerability

We welcome coordinated disclosure. Send vulnerability reports to security@btadvisory.io. We aim to acknowledge reports within 3 business days. Baseline Telemetry Advisory does not operate a paid bug bounty.

Hosting and data residency

Primary application data lives in a managed Postgres service hosted in eu-west-2 (London, United Kingdom). Backups remain in the same region.
Frontend assets are served through a managed edge network. Edges hold cached static assets and request metadata only; not primary personal data.
Full list of sub-processors, with region and transfer mechanism, at /subprocessors.

Encryption

In transit: TLS 1.2 or higher, terminated at the managed edge and application platform.
At rest: provider-managed key management for database and storage.

Audit trail

Every workspace action that affects user roles, memberships, invites, publications, and exports is written to an append-only audit trail, and so is every attempt that gets blocked by role or tenant permissions, whether that's a database rule or a check inside the application itself. Rows are retained for 24 months under GDPR art. 5(2) accountability. Update and delete are blocked at the database level, so no row can be edited or pseudonymised once written; an erasure request does not remove or alter an existing entry.

Data collection and use

Account data (name, work email, job title, company) collected at sign-up.
Engagement data uploaded by clients into their tenant workspace.
Security logs (IP, user agent, sign-in and MFA events) retained for 24 months.
No analytics, advertising, or cross-site tracking inside the workspace itself. See /cookies for what runs on the public site.

Retention and deletion

Engagement data: engagement duration plus 24 months by default.
Audit trail: 24 months.
Handover exports: client-owned; retained on the same schedule as engagement data (above), then deleted, subject to the legal hold below.
Deletion requests: email privacy@btadvisory.io. We acknowledge and act within 30 days.

Legal hold and statutory retention

We honour deletion requests except where we are required to keep records by law (for example tax and invoicing records for six years), for accountability under GDPR art. 5(2), or where the records are needed to establish, exercise, or defend a legal claim, including under a litigation or regulatory hold. Anything outside that scope is deleted or pseudonymised, the retained records are restricted to storage and not used for anything else, and we delete them once the ground expires.

Where we act as processor for a client workspace, we delete or return data on the controller's instruction. If that instruction conflicts with a legal requirement to keep the records, we tell the controller before acting. Full detail in the retention table and the Data Processing Agreement.

Incident response

Security contact: support@btadvisory.io.
Where Baseline Telemetry Advisory acts as processor, we notify the affected client controller without undue delay, and in any event within 72 hours of becoming aware of a Personal Data Breach, so they can meet their own GDPR art. 33 obligation.
Where Baseline Telemetry Advisory acts as controller, we notify the Data Protection Commission (Ireland) and, for UK data subjects, the Information Commissioner's Office within 72 hours of becoming aware, in line with GDPR art. 33.
Coordinated disclosure welcome. Report vulnerabilities to the same address.

Reliability and observability

Public liveness and readiness endpoints at /api/public/health and /api/public/readiness; deep readiness probes the database within a 2-second budget.
An independent external uptime monitor polls the health endpoint on a short interval and pages the on-call address on failure, independent of our infrastructure. It also powers our public status page at status.btadvisory.io, which is hosted off our infrastructure on separate DNS, carries incident history, and accepts email subscriptions. It stays reachable when btadvisory.io is not.
Live probe summary at /status, refreshed every 30 seconds. That page is served by the platform it measures, so during a full outage updates are posted to status.btadvisory.io first, then sent to impacted engagements by email from support@btadvisory.io.
Server and browser errors are captured by a managed error-tracking service in the EU for triage, covering the delivery workspace as well as the public site; payloads exclude request bodies and authentication tokens. A browser error also captures a masked session replay of the moments leading up to it (all text and input values masked, all media blocked); a healthy session is never recorded.
Rate limiting is enforced at the edge on authentication, booking, privacy-request, and health endpoints, backed by a Postgres-durable counter so limits survive isolate restarts.
Strict security headers on every response: HSTS with preload, a locked-down Content Security Policy, X-Frame-Options: DENY, and Referrer-Policy: strict-origin-when-cross-origin.

Business continuity and disaster recovery

Recovery point objective (RPO): 24 hours. Recovery time objective (RTO): 6 hours for a managed platform outage, 72 hours for a full rebuild on alternative infrastructure.
The managed Postgres database is protected by automated backups and point-in-time recovery held by our infrastructure provider. In addition, Baseline Telemetry Advisory takes a quarterly logical export of the database and stores it in an encrypted advisor vault, retained for four quarters.
Each engagement can be exported at any time from /portal/deliverables → Download handover bundle. The ZIP contains published deliverables, framework scoping, control mappings, uploaded evidence, and portfolio history, so clients hold a self-contained copy of their engagement independently of Baseline Telemetry Advisory.
Restore drills run quarterly. Each drill exercises the database export, a tenant handover bundle, a secret rotation, and the external health and readiness probes. Results are logged internally and any failed check opens a corrective action tracked to closure before the next drill.
Audit trail is append-only with 24 month retention, enforced by a database trigger. Transient counters (rate limits) are pruned on a nightly schedule.

AI and managed services

Some workspace features use managed AI services when enabled for an engagement. They process only the content a user submits to that feature. The providers, processing locations, and transfer safeguards are listed in our Sub-processors notice. AI features can be disabled per engagement, and AI-assisted outputs are reviewed by Baseline Telemetry Advisory before delivery.

Baseline Telemetry Advisory may use managed AI and coding assistants for limited internal research, drafting, coding, and analysis. They are not a routine route for client workspace content, and we do not intentionally submit client secrets, credentials, raw evidence, sensitive personal data, or confidential engagement material. Clients may request that AI-assisted processing be excluded from their engagement.

A separate, disclosed process, Drift Watch, uses Anthropic's Claude to read Baseline Telemetry Advisory's own source code and a dedicated internal reference tenant (a permanent fixture we maintain for exactly this purpose, never a real client engagement) to verify the platform's own behaviour against the live database on a recurring schedule. It is not authorised to query any other tenant, and it never processes a client's engagement data. Every tenant runs on the same underlying structure, so a fix that comes out of this audit applies across the board rather than to one client's workspace.

Baseline Telemetry Advisory uses a managed business productivity suite for email, bookings, documents, and administration. A managed transactional email provider sends authentication messages, invitations, booking confirmations, reminders, and operational notifications.

Evidence requests

Prospective clients and investors can request supporting information about Baseline Telemetry Advisory's own security and privacy practices by emailing legal@btadvisory.io. We aim to respond within 5 business days.

Available without an NDA: this Trust page, our Privacy Policy, Data Processing Agreement, Sub-processors, System status, Master Services Agreement, and Statement of Work.
Subject to review and scope under NDA: our supplier register with named tooling, scan summaries, and business continuity and disaster recovery test records.

Workspace handover bundles and buyer evidence packs are client engagement deliverables. They support services delivered to clients and are not Baseline Telemetry Advisory prospect or investor evidence packs.

Legal

See Privacy Policy, Data Processing Agreement, Terms of Service, and Cookies.