Confidentiality and information security at ELE

Confidentiality is your decision, not ours

What's confidential will always be decided by you. If you tell us something can't be published, we will act on that decision, even if the same information is sitting in the public domain. Where you haven't told us, we won't guess: we'll highlight any questions or areas of inconsistency and let you decide.

That principle runs through the drafting itself. We mark confidential material clearly, from first draft to final version. Every time a submission is revised, merged or restructured, we check that nothing confidential has crept into text a directory could publish.

Cyber Essentials Plus certified

We're the only legal directories agency with Cyber Essentials Plus certification, the highest level of the UK government's Cyber Essentials scheme. Unlike the standard self-assessment, Plus means a qualified assessor has tested our systems, devices and processes hands-on, including vulnerability testing and internal and external scans. We're also working towards ISO 27001.

How your information is protected

Everything lives in Google Workspace. Nothing is worked on locally, nothing is printed as standard, and removable media (USB drives and the like) are prohibited for client files.

Access is granted per person, per role, on a least-privilege basis: each client's information sits in its own folder, and team members can only see the clients they work on. Multi-factor authentication is enforced across all accounts, and our password policy follows NCSC guidance.

Data is encrypted at rest (AES-256) and in transit (TLS 1.2/1.3). All endpoints run SentinelOne endpoint detection and response, monitored by a 24/7 managed detection and response service. Security patches are applied within 14 days, with high-priority vulnerabilities prioritised. Automated, encrypted backups run across our Workspace through Afi Backup, restorable at file, user or domain level.

Personal data is stored on servers within the EEA. Full details, including retention periods, are in our Data Protection Notice.

How we use AI

AI is one of the tools we work with. We do not use it as a shortcut, and it's not the answer to everything: some pieces of work benefit from it, some don't, and knowing the difference is part of our job as directories and content experts. When we do use it, it is to take on some of the routine work so our consultants' hours and expertise go where you actually need them: judgement, sector and directories knowledge and strategic thinking.

Our experts lead, AI assists. Always. We never share confidential client information with AI tools, and we work only with a small number of carefully selected, secure tools we've vetted ourselves; personal accounts and free apps are not permitted for client work. Every piece of AI-assisted work is materially edited by a human and reviewed by at least one further human before it reaches you, and we verify anything factual rather than taking a tool's word for it. Our full AI Policy is public, and our internal AI Use Policy and AI Literacy Statement are available on request.

Our people

Everyone at ELE signs a confidentiality agreement, and those obligations continue after they leave. Right to work and references are checked before any offer is confirmed. When someone leaves, their access is revoked and passwords are reset immediately.

At the end of your engagement

Confidential client material is securely deleted at the end of the contract period. If anything is ever sent or accessed in error, it's deleted immediately.

Happy to put it in writing

We will gladly:

• Sign an NDA provided by your firm
• Sign your contractor code of conduct
• Complete your information security questionnaire
• Discuss any further security and confidentiality measures you might have for working with your firm or chambers

For more information please get in touch at contact@ele.team.