Information Security & Data Protection

• At SHE, safeguarding confidential, personal, and project-related data is integral to our business operations. We implement an Information Security Governance Framework embedded directly within our ISO 9001-aligned Quality Management System (QMS), ensuring leadership oversight, periodic reviews, and alignment with applicable European data protection requirements.

​

• Client project data managed within SHE’s Microsoft 365 environment is stored, processed, and backed up within European Union (EU) data centres in line with Microsoft’s data residency commitments. Access to project systems is governed by technical and organisational controls, ensuring data is appropriately protected and accessible only on a need-to-know basis.

​

• SHE protects sensitive client data through multi-layered security controls managed in partnership with our Managed Security Service Provider (MSSP). Our technical environment enforces strict access management, full-disk encryption, automated patching, and 24/7 threat detection.

​

• While SHE falls outside the direct statutory scope of the European NIS2 Directive, we proactively support our enterprise clients' supply chain risk management needs. In 2026, a formal NIS2 Supply Chain Assessment (Basic Assurance) was executed in collaboration with our MSSP to audit and confirm our IT best practices against recognized European cybersecurity standards.