Trust & Compliance
Trust and compliance
Mason & Co IT Consultancy LTD helps organisations design, implement and improve connected business systems, automation, data platforms and AI-enabled services. Trust is supported through clear accountability, proportionate controls and decisions that reflect each client’s regulatory, security and operational requirements.
This page explains Mason & Co’s general approach. Specific commitments for a client engagement are recorded in the applicable proposal, statement of work, contract and, where required, data processing agreement.
Data protection and privacy
Mason & Co processes personal information in accordance with applicable UK data protection requirements, including the UK GDPR and Data Protection Act 2018. Its role may vary by activity. Mason & Co is a controller for information used to operate the website and manage business relationships. During client delivery, it may act as a processor, an independent controller or neither, depending on the service and the parties’ responsibilities.
Personal information is handled for defined purposes, limited to what is necessary and retained only for as long as it is needed. More information about website and business-contact data is available in the Privacy Policy.
Data residency and international transfers
Mason & Co does not make a blanket claim that every client’s data remains in the United Kingdom. Data location depends on the client’s chosen platforms, subscription region, configuration, integrations, support arrangements and approved suppliers.
Where data residency is important, Mason & Co works with the client to identify relevant data flows, hosting locations and sub-processors before implementation. Client-specific residency requirements can be recorded in the solution design, statement of work or data processing agreement.
If personal information must be transferred internationally, the responsible parties should confirm that a valid transfer mechanism and appropriate safeguards are in place, such as UK adequacy regulations, the International Data Transfer Agreement or the UK Addendum, where applicable.
Security approach
Controls are selected in proportion to the information, service and risk involved. Depending on the engagement and capabilities of the selected platforms, this may include:
- role-based and least-privilege access;
- multi-factor authentication and managed user access;
- encryption in transit and at rest;
- audit logging, monitoring and traceability;
- controlled configuration, testing and release processes;
- backup, retention and recovery arrangements;
- incident identification, escalation and response; and
- periodic access and configuration reviews.
Exact controls and responsibilities are agreed for each engagement. No website statement replaces the client’s own risk assessment, security approval or regulatory obligations.
Third-party platforms and suppliers
Solutions may use services provided by organisations such as Zoho, Microsoft, cloud infrastructure providers, communications platforms and AI model providers. Their certifications, audit reports and hosting commitments belong to those providers and do not automatically constitute a certification of Mason & Co.
Platform and supplier choices should be assessed against the client’s functional, security, privacy, resilience and residency requirements. Material sub-processors and dependencies can be documented as part of the engagement.
Responsible AI and automation
For AI-enabled and automated services, Mason & Co promotes proportionate governance throughout the lifecycle. This includes defining the intended purpose, minimising data use, assessing provider and model risks, testing outputs, maintaining appropriate human oversight, recording key decisions and monitoring live operation.
Where the proposed processing is likely to create a high risk to individuals, the client should consider a Data Protection Impact Assessment and any additional sector-specific assessment before deployment.
Regulated environments
Mason & Co can design solutions with the expectations of regulated organisations in mind. References to frameworks or regulators describe design considerations only. They do not mean that Mason & Co, a platform or a solution is approved or certified by a regulator unless that status is explicitly documented.
Shared responsibility
Trust and compliance are shared responsibilities. Mason & Co is responsible for the services and commitments it agrees to deliver. Clients remain responsible for their lawful purposes, user access, data quality, retention decisions, internal policies and regulatory approvals unless an agreement expressly allocates a responsibility differently.
Report a security issue
If you believe you have found a security vulnerability affecting masonitc.co.uk or a service operated directly by Mason & Co, email info@masonitc.co.uk with the subject “Security vulnerability report”. Include the affected address or service, a clear description, steps to reproduce the issue and the potential impact. Do not include personal information or confidential client data unless Mason & Co has provided an appropriate secure method.
Please act in good faith and avoid accessing, downloading, changing or deleting data that does not belong to you. Do not disrupt services, use social engineering, perform denial-of-service testing or carry out high-volume automated testing. Allow a reasonable period for investigation and remediation before making details public.
Mason & Co will review credible reports, acknowledge receipt where contact details are supplied and provide updates where reasonably practicable. This reporting process is not a bug-bounty programme and does not offer payment unless agreed in writing beforehand.
Questions and assurance requests
To discuss security, privacy, data residency or assurance requirements for a proposed engagement, email info@masonitc.co.uk. Requirements should be confirmed before delivery begins so that they can be reflected in the architecture and contractual documentation.
Review information
This page was last reviewed on 29 October 2026.