Identity security
Multi-factor authentication on every staff account, conditional access on our own tenant, and privileged access granted deliberately rather than held as standing rights.
Trust & security
You are trusting us with your systems. Here is how we handle that.
An IT provider holds administrative access to almost everything you own. That deserves scrutiny, so this page sets out what we do about it — including the parts that are less flattering than a certificate logo.
- Least-privilege access
- EU & UK data locations
- GDPR-aligned by design
- Scoped accessonly what support needs
- Actions loggedincluding ours
- Encryptedin transit and at rest
- Incident processdefined, not improvised
Our controls
What we do to protect client data
These are the controls we operate on our own systems and on the access we hold into yours. They are the same things we would ask of any supplier holding this much access to us.
Employee access
Engineers hold the access their role requires and no more. Access is reviewed, and removed on the day someone leaves.
Encryption
Data encrypted in transit and at rest across the platforms we operate, and full-disk encryption on every device our staff use.
Logging & audit
Administrative actions are logged, including ours. If you ask who did what to your systems and when, that should have an answer.
Incident response
A defined process for detection, containment, investigation, recovery and notification — for incidents affecting us as well as ones affecting you.
Supplier management
The platforms we depend on are assessed before adoption and reviewed, with data protection terms in place with each.
Backup & continuity
Our own systems are backed up and tested on the same basis we insist on for clients. We would be a poor advertisement otherwise.
Data locations
Client data is held in EU or UK regions. The specific location for your service is documented rather than assumed, and we will confirm it in writing.
Data protection
Our processing is designed and operated in line with GDPR requirements, and we will enter into a data processing agreement with you.
Staff screening & training
Staff are bound by confidentiality obligations and receive security awareness training. Access to client systems is tied to role.
Patching & hardening
Our own estate is patched and monitored on the same schedule as our clients'. An unpatched MSP is a supply-chain risk to everyone it serves.
Responsible disclosure
A published route for reporting a vulnerability in our systems, and a commitment to investigate and respond rather than to argue.
Being precise about it
What we claim, and what we do not.
Security pages are full of logos that imply more than they say. We would rather be exact, because the distinction matters to anyone doing genuine supplier due diligence — and because a claim you can check is worth more than one you cannot.
- We align our practice to the ISO/IEC 27001 framework. We do not hold ISO 27001 certification.
- We follow UK Cyber Essentials principles. Certification is an implementation in progress.
- Our processing is designed and operated in line with GDPR requirements. No provider can make you "fully GDPR compliant".
- We hold no formal vendor accreditations we have not evidenced, and we do not display badges suggesting otherwise.
- Where a client needs formal certification from a supplier, we will say so plainly rather than imply we have it.
- If any of this changes, this page changes with it.
Reporting a security issue
We want to hearIf you believe you have found a vulnerability in a CaminhoIT system, please tell us. We will acknowledge your report, investigate it, and keep you informed of the outcome.
support@caminhoit.com
Use the subject line “Security disclosure” so it is routed straight to the right people.
What to include
The affected system, what you observed, and enough detail for us to reproduce it.
What we ask
Please give us reasonable time to investigate and fix before disclosing publicly, do not access or alter data belonging to other people, and do not run testing that would degrade a service.
What we will do
Acknowledge your report, investigate it seriously, and tell you what we found and what we changed. We do not currently run a paid bug bounty.
If something happens to us
How we would handle an incident affecting you.
-
Detect & contain
Isolate what is affected and stop it spreading, before anything else.
-
Tell you
Promptly, with what we know and what we do not. We would rather tell you early and imprecisely than late and neatly.
-
Investigate
Establish what happened, what was reached, and over what period, using the logs kept for exactly this.
-
Report & change
A written account of the incident, the response and what we have changed, plus the information you need to meet your own notification obligations.
Sub-processors
Who else touches your data
Delivering a managed service means using platforms that process client data. These are the categories, and where that data sits.
| Category | What it is used for | Data location |
|---|---|---|
| Productivity & identity | Client mail, files and identity platforms that we administer on your behalf. | EU / UK |
| Monitoring & management | Remote monitoring and management tooling used to support your devices. | EU / UK |
| Backup | Backup platforms holding protected copies of client data. | EU / UK |
| Security tooling | Endpoint protection and security monitoring. | EU / UK |
| Service management | Our own ticketing, documentation and client portal. | EU |
The specific platforms used for your service, and the data protection terms that apply to each, are named in your own service documentation and data processing agreement. Ask us and we will provide the current list in writing.
The uncomfortable question
Your IT provider is your largest supply-chain risk.
It is worth saying plainly. We hold administrative access to your identity platform, your devices and your backups — which makes us a route into your business, and a target because of it. Attacks on managed service providers are attractive precisely because one compromise reaches many organisations. We treat our own security as your security, and we would encourage you to hold any provider, including us, to that standard.
- Ask us hard questionswe would rather you did
- Ask for it in writingwe will put it in writing
- Hold every supplier to itincluding this one
Questions
Supplier due diligence questions
Are you ISO 27001 certified?
No. We align our internal controls to the ISO/IEC 27001 framework and follow UK Cyber Essentials principles, and we are careful to describe that as alignment rather than certification. If certification from your suppliers is a requirement, tell us early — we would rather be ruled out honestly than win work on an implication.
Can your engineers read our data?
Administrative access to a platform does technically make content reachable — that is true of every managed service provider, and any who tells you otherwise is being imprecise. What matters is the controls around it: access scoped to what support requires, privileged actions logged and auditable, staff bound by confidentiality obligations, and stricter arrangements such as break-glass procedures available where your governance needs them.
Will you sign our NDA and data processing agreement?
Yes, both are routine. Send them over and we will review and sign, or use ours if you would rather start from a draft. If your agreement contains obligations we cannot actually meet, we will tell you which and why instead of signing and hoping.
Where is our data held?
In EU or UK regions, selected to suit where you operate and any obligations you have about data location. The specific regions for your Microsoft 365 tenant, your backup service and our own service management systems are recorded in your documentation, so it is a fact you can cite rather than an assumption.
What happens if CaminhoIT is breached?
We contain first, tell you promptly with what we know at that point, investigate properly using the logs kept for the purpose, and give you a written account of what happened and what has changed — including the information you need for your own notification obligations. We would rather tell you early and imprecisely than late and tidily.
How do we report a security problem to you?
Email support@caminhoit.com with "Security disclosure" in the subject. We will acknowledge it, investigate, and tell you what we found and what we changed. We ask for reasonable time to fix before public disclosure, and that testing does not touch other people's data or degrade a live service. We do not run a paid bug bounty.
Due diligence
Send us your security questionnaire.
We will complete it properly, and we will tell you where the answer is not what you were hoping for.