Trust, stated plainly.
We’re asking you to put your evidence in our hands. Here’s what we do with it, who checks us, and what we’ll send you on request.
Who audits us.
Precept is audited against SOC 2 Type II by Greaves & Lind LLP. Our current report covers 1 April 2025 to 31 March 2026, with no exceptions noted. We chose Greaves & Lind ourselves and pay them directly, the same arrangement we ask you to keep with yours.
For the months since 31 March, we send a bridge letter signed by our CEO and CISO, stating that no material changes have been made to the controls in scope. The next report, covering to 31 March 2027, follows in May 2027.
Request the report: security@precept.example. We send it under a standard NDA, usually the same working day.
Security incidents: none.
We count as an incident any confirmed unauthorised access to customer data, any unauthorised change to or loss of it, or any event we would have to report to a regulator or to a customer under contract.
By that definition, we have had none since Precept was founded. If that changes, affected customers hear from us within 24 hours and this line changes the same day.
Your evidence, your keys.
- Evidence is encrypted in transit (TLS 1.2 or later) and at rest (AES-256).
- You hold the keys. Each workspace’s data is encrypted with a key in your own cloud KMS, so revoking it makes your data unreadable to us.
- Your auditor’s seat is read-only and expires when fieldwork ends.
- We don’t train models on customer evidence, and we don’t read it unless you open a support ticket that asks us to.
Subprocessors.
We list our subprocessors on request rather than on this page, so the list you receive is current on the day you receive it, with each one’s purpose, location and audit status. Customers are told 30 days before any change.
Who at Precept can see what.
Engineers have no standing access to production data. Access is requested per ticket, approved by a second engineer, expires after four hours, and is logged where your auditor can see it if you ask.