Overview
Thoughtful takes the confidentiality, integrity, and availability of business and customer information seriously. We apply layered safeguards across our platforms, workflows, and supporting services to reduce risk and support responsible handling of data.
Our security practices are designed to align with practical operational needs, protect critical assets, and continuously improve as technologies, threats, and business requirements evolve.
Infrastructure and Access Controls
We use access controls to limit system and data access to authorized personnel who require it for their role. Authentication, authorization, and permission boundaries are applied to help reduce unnecessary exposure across environments and tools.
- Role-based access is used where appropriate to keep privileges limited and targeted.
- Administrative access is restricted and reviewed as part of operational maintenance.
- We work to ensure hosting and connected services are configured with security-conscious defaults.
Application Security
We incorporate secure development practices throughout delivery, including attention to dependency hygiene, configuration review, and exposure reduction for public-facing systems. Security considerations are part of the broader engineering process rather than a final-step add-on.
Where relevant, we review application flows, inputs, permissions, and integrations to reduce avoidable vulnerabilities and improve resilience.
Data Protection
We aim to protect sensitive information in transit and at rest using appropriate technical and organizational measures. Data handling is approached with minimization in mind, and access is limited to the extent necessary to support service delivery and operations.
Additional details about personal data handling are available in our Privacy & Cookie Policy.
Monitoring and Response
We support ongoing maintenance and monitoring practices to help identify issues, respond to operational risks, and keep systems current. This includes routine updates, environment upkeep, and attention to service health and reliability.
If we become aware of a material security issue affecting our systems or services, we will assess impact, take appropriate remediation steps, and communicate as needed based on the nature of the issue.
Responsible Disclosure
If you believe you have identified a security concern related to Thoughtful, please contact us with relevant details so the issue can be reviewed. We ask that you avoid actions that could disrupt services, access data without authorization, or affect other users.
Contact
For security-related enquiries, please contact sales@thoughtful.digital. For general legal information, you can also review our Terms & Conditions.