Cyber Security and Information Protection Policy

This policy covers all information we receive or create in the course of business, including customer drawings and models, quotations, purchase orders and personal data, and all computers, servers, networks, cloud services, machine controllers and mobile devices used to process it.

Customer drawings and technical data are used only to quote, manufacture and inspect that customer's parts. They are never shared with other customers or with third parties, except subcontractors who need them for the work and who are bound by confidentiality.

Access to drawings is limited to the people who need it for their role. We sign non-disclosure agreements on request and honour their terms.

When a customer asks, or a programme ends, drawings and data are returned or securely deleted as agreed.

Every user has an individual account; shared logins are not permitted. Access rights follow the least-privilege principle and are removed promptly when a person changes role or leaves.

Strong passwords are required, and multi-factor authentication is enabled for email, cloud storage and remote access.

Operating systems, software and firmware are kept up to date with security patches, and endpoint protection is installed and active on all computers.

Office and machine networks are protected by firewalls. Machine controllers and the programs loaded to them are protected from unauthorised changes.

Business-critical data is backed up regularly, with at least one copy held offline or off site, and restoration is tested periodically.

Information sent over the internet is protected with encryption, and portable devices and removable media are encrypted or controlled.

Employees receive training on information security, including how to recognise phishing and social-engineering attempts, and agree to an acceptable-use policy for company systems.

Suppliers and service providers who handle our or our customers' information must protect it to an equivalent standard.

Suspected security incidents are reported immediately, contained, investigated and recorded. Where a customer's information may have been affected, the customer is informed without undue delay, together with the actions taken.

Personal data is handled in line with the Digital Personal Data Protection Act, 2023 and our privacy policy.

If you believe you have found a security weakness in our systems or website, please report it to the email address on our contact page. We will acknowledge and investigate every report.