Encryption & Data Security Policy

Everything the firm holds for a client is treated as confidential by default, whether or not it is marked so. Security measures follow from that presumption: data is protected in proportion to its sensitivity, and access follows need, not convenience.

All connections to this website, and all correspondence passing through our systems, travel over encrypted channels (TLS). Unencrypted connections to the website are not accepted. Where a matter warrants it, we agree dedicated secure channels with the client for the exchange of documents rather than relying on ordinary email.

Client files, correspondence, and the databases behind this website are stored on infrastructure that encrypts data at rest using current industry standards (AES-256 or equivalent). Devices used by the firm are themselves encrypted, and protected by authentication.

Access to client information is restricted to those working on the matter. Administrative access to our systems is limited, individually attributed, and protected by strong authentication. Credentials are never shared, and access is withdrawn the moment it is no longer needed.

Every member and employee of the firm is bound by professional secrecy under Cypriot law and by the duties of the advocate’s profession. These obligations continue after an engagement ends, and after employment ends. Third parties who touch our systems or our matters are bound by written confidentiality undertakings before they touch either.

Ordinary email, though encrypted in transit between modern providers, is not a vault. For documents of consequence we prefer, and will propose, more protected channels. If you hold particular requirements for secure communication, tell us at the outset and we will meet them.

Information is kept for as long as the matter and the law require, as set out in our Privacy Policy, and no longer. When retention ends, electronic data is deleted from live systems and backups on their cycle, and paper is destroyed securely.

Should a breach of security ever affect personal data, the firm will act without delay: containing the incident, assessing its reach, notifying the Office of the Commissioner for Personal Data Protection within the time the GDPR allows where required, and informing affected clients candidly where the risk to them demands it.

These measures are reviewed as technology and threats evolve, and after any incident. The date at the head of this page records the last revision.