Your Information. Handled with Care.

A&MR follows a simple principle: use the minimum information and access reasonably required to perform the agreed work, and handle that information only for legitimate business purposes connected to the engagement.

• Client information is treated as confidential.
• Access is limited to the agreed work and business purpose.
• Information is not sold, repurposed or disclosed for unrelated commercial use.
• Sensitive information is not intentionally copied across multiple systems when the work can be completed within the client’s existing platform.
• Questions about access or confidentiality can be documented in the engagement terms or a separate NDA/DPA where appropriate.

A&MR does not ask clients to disable multi-factor authentication. Where a client shares a login, the client remains in control of the account and is encouraged to change or revoke access when the engagement ends or access is no longer required.

Client files may be accessed or stored through OneDrive, the client’s own approved systems, and limited local working storage when necessary to complete the engagement. Local working devices are password protected and protected with BitLocker full-drive encryption.

• Microsoft Defender and Windows Firewall are used on the primary Windows working environment.
• Local devices used for client work are password protected and protected with BitLocker full-drive encryption.
• OneDrive is used for cloud file storage where appropriate.
• Working copies should be limited to what is necessary for the task.
• Files should not be retained indefinitely simply because they were once required for a project.

A&MR is founder-led, which keeps accountability and access straightforward. Client information is not shared with a subcontractor or additional service provider for delivery of the work without prior client authorisation where that sharing would involve access to client information.

• A&MR is willing to sign reasonable confidentiality agreements and NDAs.
• Client information is not disclosed to friends, unrelated businesses or unauthorised third parties.
• If future subcontractor support is required, the client will be informed and appropriate confidentiality/data-protection requirements should be put in place before access is granted.
• Access should be limited to the information each authorised person actually needs.

A&MR may use AI-assisted productivity tools for drafting, structuring, research support or workflow efficiency. These tools are not treated as a place to deposit raw client information.

• Personally identifiable information is removed or redacted before AI-assisted use.
• Facial images, biometric identifiers, passwords, authentication codes and access credentials are not intentionally submitted to AI tools.
• Client data should be minimised and anonymised before use.
• Confidential business information should not be submitted to public AI tools unless the client has authorised that use or an approved environment/contract provides appropriate protections.
• AI-generated output is treated as assistance, not as a substitute for review, judgement or responsibility for the work.

A&MR does not intend to retain client working files indefinitely. At the end of an engagement, client information should be returned, deleted or retained according to the client’s instructions, contractual obligations and any applicable legal requirement.

• Access to client systems should be revoked when no longer required.
• Local working copies should be deleted when there is no continuing business, contractual or legal reason to retain them.
• Where retention is legally or contractually required, access should remain restricted and the information should not be used for unrelated purposes.
• Clients may request clarification about the handling of specific working files at the end of the engagement.

If A&MR becomes aware of a suspected security incident that may affect client information, the priority is to contain the issue, assess what information may be affected, preserve relevant facts and notify the client promptly where notification is required by the engagement terms or applicable law.

Data protection works best when both sides use sensible controls. Clients are encouraged to:

• Use multi-factor authentication wherever available.
• Create separate user access for A&MR instead of sharing owner/admin credentials where the platform supports it.
• Grant only the permissions required for the agreed scope.
• Remove or change access when the engagement ends.
• Avoid sending passwords or sensitive personal data through insecure channels.
• Inform A&MR of any client-specific security, confidentiality or regulatory requirements before access is provided.

A&MR supports clients remotely. Where a client is subject to specific data-protection requirements, the parties can document appropriate processing instructions, confidentiality terms, access limitations, retention requirements and approved service providers as part of the engagement.