Security

A security consultant should be able to show their own work. Here’s how Mission Assurance Group protects client information, and how to report a security issue.

How client information is protected

• Strong sign-in. Every business account uses multi-factor authentication, with hardware security keys or device passkeys for anything that matters.
• Encrypted, managed devices. Work is done on a managed Mac with full-disk encryption, automatic updates, and a firewall.
• Managed storage. Client files live in Microsoft 365 and are shared through named, expiring links, never on USB drives or personal accounts.
• Least access. When I need access to your systems, I ask for named accounts with the minimum permissions, preferably read-only.
• Deletion on schedule. Working files are returned or deleted within 30 days after an engagement ends.
• Prompt notice. If client data in my care were ever accessed without authorization, I’d notify you within 72 hours.

This website runs without cookies, analytics, or third-party scripts, behind a strict content security policy.

Independent and honest

I don’t resell software or take referral fees, and I’ll never help you overstate your security on a questionnaire or application.

Reporting a vulnerability

If you believe you’ve found a security issue in this website or any Mission Assurance Group system, email security@missionassurancegroup.co with enough detail to reproduce it. I’ll acknowledge your report within 3 business days.

Please act in good faith: don’t access or change data that isn’t yours, don’t disrupt the service, and give me reasonable time to fix the issue before sharing it publicly. I won’t pursue legal action against good-faith research that follows these guidelines. The same details are in our security.txt file.

Having an incident yourself?

If your organization is dealing with a security incident, go to Incident help for first steps and how to reach me.