Customer Security

Confidence through governance, people, process and technology

At Nolan Business Solutions, protecting customer information is fundamental to how we deliver services. Security is embedded into our governance, operations, technology platforms, development practices, and customer service processes.

Our Commitment

As a provider of business software consultancy, software development, integration, support and managed hosting services, Nolan recognises that customers trust us with business information and depend on the availability and integrity of the services we provide.

Our information security programme is designed to protect information and systems against unauthorised access, disclosure, alteration, loss, and disruption. It combines governance, people, process and technology controls, supported by documented policies, risk management, and management oversight.

 

Our security principles

Least privilege Access is limited to authorised users with a legitimate business need and is reviewed periodically.	Secure change Material production changes are documented, tested, reviewed, and approved before release.
Defence in depth Identity, endpoint, network, logging, monitoring, and recovery controls work together to reduce risk.	Shared responsibility Nolan manages Nolan-operated controls and assesses relevant service providers. Customers retain responsibility for their own users, credentials, and environments.

 

How we protect information and services

Governance and risk management

Documented information security policies define responsibilities and expected practices across the organisation. Information security risks are assessed and treated according to their likelihood, impact, and business context. Security policies and the control environment are reviewed regularly and following material changes.

Identity and access management

Unique user accounts, role-based access, and the principle of least privilege are used to restrict access. Multi-factor authentication is required for privileged access to production environments were supported by the platform. Access is approved, provisioned, and removed through documented processes, with periodic access reviews and prompt offboarding.

Secure development and change management

Source code and work items are managed in controlled repositories with traceability from authorised change through release. Peer review, testing, deployment approvals and release of logging reduce the risk of unauthorised or defective changes. Development and production environments are segregated where appropriate, and production of customer data is not used for testing without approval and safeguards.

Operational security 

Production systems use security configuration, network access controls, endpoint protection and malware prevention appropriate to their role. Critical systems generate logs and alerts to support security monitoring, investigation, and response. Technical vulnerabilities are assessed, prioritised and tracked through remediation or documented risk acceptance.

Data protection

Personal data is handled in line with applicable data protection law and the principles of lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, retention and security. Encryption is used for remote connections and secure communications, and company devices use protective controls including encryption where appropriate.

Resilience and recovery

Backup and recovery arrangements are designed around service requirements and contractual commitments. Business continuity and disaster recovery procedures support incident response, continuation of critical activities, and return to normal operations. Recovery arrangements and backups are tested periodically, with lessons learned tracked as corrective actions.

 

Security operations and assurance 

Incident management

Personnel are required to report known or suspected security events promptly. Reported incidents are assessed, contained, investigated, and recovered through documented incident-management processes. Where a personal-data breach is notifiable, Nolan follows applicable legal and regulatory reporting requirements and communicates with affected parties as required.

Personnel security and awareness

Security responsibilities are communicated through onboarding, policy acknowledgement, and awareness activities. Employees and contractors are expected to protect information, follow acceptable-use requirements and report suspected security concerns.

Third-party and cloud services

Nolan uses established cloud and software providers, including Microsoft services and Oracle NetSuite, to support service delivery. Relevant suppliers are assessed before use; security and confidentiality expectations are established in agreements, and higher-risk providers are reviewed under the applicable shared-responsibility model.

Independent assurance

Nolan is undergoing a SOC 2 Type II examination covering Nolan Cloud Services and relevant supporting controls. Current audit activities assess the design and operating effectiveness of controls against the applicable AICPA Trust Services Criteria. The SOC 2 report is a restricted-use assurance report and will be made available to eligible customers and prospects under appropriate confidentiality arrangements when issued.

 

Customer responsibilities

Security is a shared responsibility. Specific services, contractual commitments, and responsibilities may vary by engagement. Customers should:

• Authorise users and protect credentials.
• Notify Nolan promptly of access changes.
• Configure customer-controlled environments securely.
• Review outputs, integrations, and interfaces.
• Maintain appropriate controls over data supplied to Nolan.
• Report suspected incidents without undue delay.

 

Scope of this whitepaper

This document provides a high-level overview of Nolan-operated security practices. Customer-controlled environments and controls operated solely by cloud or software providers are not Nolan-operated controls. For security reasons, this whitepaper does not disclose detailed configurations, architecture diagrams, vulnerability information, recovery procedures, or other information that could increase operational risk.

 

Customer assurance

CUSTOMER ASSURANCE Our objective is simple To provide customers with confidence that their information is protected, services are delivered securely, and security risks are actively managed throughout the organisation. ________________________________________________________________________________

 

Contact us

Security and assurance enquiries
info@nolanbusinesssolutions.com

Nolan Business Solutions Plc
Cedar House, Ancells Road
Fleet, Hampshire GU51 2UN
United Kingdom

www.nolanbusinesssolutions.com

 

Last reviewed: October 2026