Data protection at AM Networking
When we run a company's IT, we can see a lot: mailboxes, files, devices, the identity system that holds it all together. This page explains the responsibilities that come with that access and the controls we put behind them. Our privacy policy covers the data we hold about you; this page covers how we treat the data inside the systems clients trust us with.
Controller or processor — and why it matters
For most of what we do — managing a Microsoft 365 tenancy, supporting users through the helpdesk, monitoring a network — the client decides why data is processed and we act on their instructions. In UK GDPR terms, the client is the controller and we're the processor.
In plain terms: it's your data. We don't own it, we don't mine it, and we don't use it for anything beyond delivering the service you've engaged us for. An engineer resetting a password or restoring a file is doing a job on your instructions, and that's the whole of it.
For our own records — your contact details, our invoices, this website — we're the controller, and the privacy policy applies.
What we commit to as a processor
These are the standard processor obligations under UK GDPR and the Data Protection Act 2018. The data processing terms that make them contractual live in each client agreement — a signed document, not a webpage that can quietly change.
We act only on your instructions
Client data is processed for the purposes set out in your agreement with us, and nothing else. No mining it, no repurposing it, no using it to train anything.
We keep it confidential
Everyone on the team works under confidentiality obligations. Access to client environments is limited to the engineers who need it to do the work.
We secure it properly
Appropriate technical and organisational measures, in the language of the regulation. The next section lists what those measures actually are.
We help you meet your own obligations
Subject access requests, security questionnaires, supplier due diligence — when your obligations touch systems we manage, we help you answer, not hide behind the contract.
We tell you if something goes wrong
If a personal data breach affects your data, we notify you without undue delay, with what we know and what we're doing about it.
We hand it back at the end
When an engagement ends, client data is returned or deleted as your agreement sets out. Leaving us shouldn't mean losing anything.
The controls behind the commitments
Policy wording is cheap; controls are what count. These run across our own systems and the client environments we manage, and they're the same tools our cyber security service is built on.
Multi-factor authentication
MFA on our own accounts and, as standard practice, across the client environments we manage. A password on its own doesn't guard anything important.
EDR on endpoints
Endpoint detection and response on managed devices, watched by our 24/7 Microsoft Sentinel SOC. The protection we sell is the protection we run.
Encryption
Data encrypted in transit and at rest using the platform capabilities built into Microsoft 365 and Azure, configured as part of tenancy hardening.
Vulnerability and patch management
Known holes get closed before someone walks through them — patching run as a managed process, not left to whenever a machine feels like updating.
24/7 monitoring
Proactive monitoring around the clock across the systems we manage, so problems are flagged by alerts rather than discovered by users.
Access control
Least-privilege access, with joiner and leaver processes that grant access on day one and revoke it on the last. Stale accounts are a gift to attackers; we don't leave them lying around.
Standards we align with
Our security work aligns with NCSC guidance, Cyber Essentials and ISO 27001, and with UK GDPR and the Data Protection Act 2018. Alignment is the honest word: we follow the guidance and build to the standards, and we don't claim certifications we don't hold. Be wary of any provider who's vague on that distinction.
What alignment means in practice — and how it helps when your own customers send security questionnaires — is covered on our compliance page.
If something goes wrong
No provider can promise nothing will ever happen, and we won't pretend otherwise. What we can promise is the response. Incident response is a named part of our cyber security service, run by engineers who already know your environment rather than a stranger reading your network diagram for the first time mid-incident.
If a breach affects your data, we notify you without undue delay — clearly, with what we know and what we're doing about it — so you can meet your own reporting obligations, including any notification to the ICO. You'll hear it from us first, not from your users.
Questions and due diligence
If you're running supplier due diligence and need these answers in your own format, email hello@amnetworking.co.uk. Security questionnaires are routine here, not an imposition. The related documents: