Computerko Limited is committed to protecting information, systems, services, and technology environments against unauthorised access, misuse, loss, disruption, damage, or disclosure.
This Information Security Policy sets out the security principles, governance standards, and control expectations that apply across Computerko Limited’s business operations, managed services, hosted services, devices, cloud environments, communications systems, and supporting platforms.

This website and the goods and services made available through it are intended for business use only.

1. Who we are

Computerko Limited is a company registered in England and Wales.
2. Purpose of this policy
The purpose of this policy is to define the information security framework applied by Computerko Limited in order to protect:
business information;
customer information;
supplier and partner information;
systems and infrastructure;
hosted and cloud environments;
devices and endpoints;
communications services;
access credentials and accounts; and
operational continuity and trust.
Registered office: 27 Old Gloucester Street, London, WC1N 3AX, United KingdomContact email: support@computerko.co.uk

This policy is intended to support the protection of:

• confidentiality — ensuring information is accessible only to authorised persons;
• integrity — ensuring information and systems remain accurate, complete, and trustworthy; and
• availability — ensuring services and information remain accessible and operational when needed.

This policy is a master security governance document. It does not replace any contract, Privacy Policy, GDPR / Data Protection Policy, Acceptable Use Policy, Support Policy, Cloud & Hosting Policy, AI Policy, backup-specific policy, or any service-specific terms.

3. Scope

This policy applies to all information, systems, services, and technology assets owned, managed, controlled, configured, administered, supported, or used by Computerko Limited in connection with its business and service operations.
This includes, where relevant:
business information and internal records;

• customer information and service-related information;
• supplier and partner information;
• websites, portals, and online systems;
• support systems and service desk platforms;
• email and communications systems;
• cloud and hosting environments;
• shared hosting services;
• managed cloud servers;
• private dedicated application environments;
• private dedicated CRM and ERP environments;
• endpoint and device management systems;
• laptops, desktops, mobile devices, peripherals, and related endpoints;
• backups, logs, monitoring data, and audit records;
• domain, DNS, and related service infrastructure;
• credentials, authentication systems, and privileged accounts; and

third-party platforms and services used in support of Computerko Limited’s operations or service delivery.
This policy applies to:
directors;
employees;
contractors;
consultants;
temporary staff;
third parties acting on behalf of Computerko Limited;

• any person with authorised access to Computerko-controlled systems or information; and
• customers or authorised users where responsibilities are shared within a managed or hosted service environment.

4. Security objectives and principles

Computerko Limited seeks to apply proportionate, risk-aware, and business-appropriate security controls across its operations and services.
Our security objectives include:

• protecting the confidentiality, integrity, and availability of information and services;
• reducing exposure to cyber, operational, legal, and reputational risk;
• maintaining customer trust and service resilience;
• supporting lawful and responsible information handling;
• detecting, preventing, and responding to security threats and incidents;
• maintaining appropriate control over access, administration, and use of systems; and
• reviewing and improving security arrangements over time.

Computerko Limited recognises that information security is not achieved through technology alone. It also depends on governance, operational discipline, appropriate user behaviour, provider oversight, and continuous review.
5. Governance and accountability
Information security is a shared responsibility across Computerko Limited.
Computerko Limited will maintain an appropriate governance approach under which:

• management is responsible for ensuring security is taken seriously and supported appropriately;
• personnel are responsible for acting in a security-aware and responsible manner;
• access to information and systems is limited according to legitimate need;
• privileged roles carry heightened responsibility;
• security risks are considered in operational and service decisions;
• incidents, weaknesses, and suspicious activity are reported and addressed appropriately; and
• third parties engaged in relevant service delivery are subject to reasonable security consideration.

All persons within scope of this policy are expected to cooperate with lawful and reasonable security requirements and controls.

6. Access control and identity management

Computerko Limited will seek to ensure that access to systems, services, environments, data, and administrative functions is controlled appropriately.
This includes the principles that:

• access should be granted only where there is a legitimate business or service need;
• access should be appropriate to the user’s role and responsibilities;
• privileged access should be restricted and controlled;
• access rights should not be broader than reasonably necessary;
• access should be reviewed and removed where no longer required;
• dormant, unnecessary, or unauthorised access should be addressed; and
• users must not seek to gain access beyond that which has been authorised.

Computerko Limited may apply different access models across different services depending on the nature of the environment, the customer arrangement, and the level of operational control required.
7. Authentication and credential security
Computerko Limited expects credentials and authentication controls to be handled securely and responsibly.
This includes the principles that:

• passwords and authentication credentials must be protected;
• account access must not be shared inappropriately;
• multifactor authentication may be required where appropriate;
• tokens, keys, secrets, and access credentials must be stored and used securely;
• suspected compromise of any account or credential must be reported promptly; and
• unauthorised use of another person’s account or credentials is prohibited.

Computerko Limited may apply authentication requirements and account protections appropriate to the service, system, or risk level involved.
8. Device and endpoint security
Computerko Limited may use and support managed devices, endpoints, and endpoint-related systems as part of its business operations and managed services.
Computerko Limited will seek to maintain appropriate device and endpoint security through measures such as:
controlled device configuration;
endpoint protection tools;
patching and maintenance;
access control;
device monitoring where appropriate;
remote management where relevant; and

• reporting and response processes for lost, stolen, or compromised devices.

Managed devices and endpoints must not be tampered with in a way that undermines security, monitoring, supportability, or control.

9. Cloud, hosting, and infrastructure security

Computerko Limited provides, manages, supports, or administers cloud and hosting environments as part of its services.
Computerko Limited will seek to apply appropriate security controls across cloud and hosting environments, which may include:
secure provisioning principles;
controlled administrative access;
environment-specific configuration;
maintenance and patching;
monitoring and logging;

• separation or isolation appropriate to the service model;
• controlled use of provider capabilities; and
• security-related review and intervention where necessary.

The precise security characteristics of a cloud or hosting service may vary depending on whether the environment is shared, managed, dedicated, application-specific, or reliant on third-party infrastructure.

10. Information and data handling security

Computerko Limited will seek to ensure that information is handled appropriately according to its sensitivity, purpose, and risk profile.
This includes the principles that:

• information should only be accessed, used, stored, transmitted, disclosed, or retained where there is a legitimate reason to do so;
• information should not be exposed, copied, or shared unnecessarily;
• customer and business information should be protected against inappropriate disclosure;
• sensitive information should be subject to appropriate handling controls;
• records, logs, and service information may be retained where necessary for audit, operational, security, or legal purposes; and
• information handling should align with applicable legal, contractual, operational, and security obligations.

This policy addresses information security from a security and governance perspective. Personal data governance is also addressed separately through Computerko Limited’s Privacy Policy and GDPR / Data Protection Policy.
11. Monitoring, logging, and detection
Computerko Limited may use logging, monitoring, alerting, diagnostics, and related security or operational tools to protect its business and services.
Such measures may be used for purposes including:
detecting suspicious or malicious activity;
identifying faults, misuse, or integrity issues;
investigating incidents and anomalies;
maintaining service stability and security;
preserving evidence where needed;
reviewing access and administrative actions; and

• supporting compliance, audit, quality, or service assurance.

Where such monitoring relates to personal data or communications, it will be carried out in line with applicable legal and policy requirements.

12. Vulnerability management, patching, and maintenance

Computerko Limited recognises that vulnerabilities and outdated systems can create security risk.
Computerko Limited will therefore seek to:
maintain systems appropriately;

• apply patches, updates, or mitigations where necessary;
• assess security weaknesses or exposures as they arise;
• take urgent action where there is a material security risk; and
• manage change and maintenance in a way that supports security, integrity, and service continuity.

Some updates or maintenance activities may be carried out without prior notice where reasonably necessary to manage security or operational risk.

13. Incident reporting and response

Any suspected or actual security incident, compromise, misuse, or relevant weakness should be reported promptly through the appropriate internal or service route.

Computerko Limited may respond to a security incident by taking steps such as:
investigation;
containment;
access restriction;
service isolation;
patching or reconfiguration;
recovery actions;
coordination with providers or customers;
documentation and evidence preservation; and
escalation where necessary.

Security incidents involving customer services or third-party providers may require coordinated handling across multiple parties.

Nothing in this policy guarantees that every incident can be prevented. The purpose of this policy is to support a structured and proportionate response when incidents arise.

14. Third-party and supplier security

Computerko Limited may rely on third-party providers, platforms, suppliers, or infrastructure in order to deliver services and operate its business.
Computerko Limited will seek to apply reasonable security consideration to such relationships, including where relevant:

• use of established providers appropriate to the service;
• consideration of security and risk in provider selection and continued use;
• restricting shared data or access to what is reasonably necessary;
• recognising provider dependencies in security planning; and
• coordinating with providers where security incidents or operational issues arise.

However, Computerko Limited does not directly control all third-party infrastructure, systems, services, or security decisions. The security posture of a given service may therefore be influenced by external provider behaviour, controls, and incidents.
15. Remote access and administrative activity
Computerko Limited may use remote access, remote administration, or remote support methods where necessary for service delivery, support, security, or maintenance.
Such access should be:
authorised;

• limited to legitimate business or service purposes;
• controlled appropriately;
• subject to security expectations; and
• recorded, logged, or reviewed where appropriate.

Privileged or high-impact administrative actions may require additional controls, approvals, or documentation depending on the environment and the risk involved.

16. Backups, resilience, and continuity from a security perspective

Computerko Limited recognises that security and continuity are closely linked.

Backups, recovery capabilities, resilience measures, and continuity planning may form part of the broader security framework by helping to:

• reduce the impact of incidents;
• preserve recoverability;
• support restoration where appropriate; and
• protect service and information availability.

Not all services include the same backup, resilience, or recovery profile. Hosting or service provision alone should not automatically be interpreted as providing a full disaster recovery service unless expressly agreed.

17. AI and automation in security-related operations

Computerko Limited may use automation or AI-assisted tools in operational, computational, monitoring, or infrastructure-related contexts to support efficiency, detection, maintenance, or service performance.
Computerko Limited does not use identifiable personal data to train AI models as part of its standard operations.

Any AI-assisted use remains subject to human oversight and review and must be applied in a way that supports lawful, proportionate, and responsible service operation.

18. Customer and user responsibilities

Where customers or authorised users access, administer, or use Computerko-managed systems or services, they are expected to:

• protect credentials and access methods;
• use services responsibly and lawfully;
• report suspected compromise, misuse, or security issues promptly;
• cooperate with reasonable security or containment actions;
• avoid undermining or bypassing security controls; and
• ensure that customer-side actions do not create unreasonable security risk.

Security is strongest where Computerko, customers, and authorised users each act responsibly within their area of control.

19. Protective action and enforcement

Where reasonably necessary to protect systems, services, users, infrastructure, or information, Computerko Limited may take protective action, including:
restricting access;
suspending accounts or services;
isolating systems or environments;
investigating suspicious activity;
requiring remediation;
applying urgent changes or controls;
escalating matters internally or externally; and

• notifying affected parties, providers, or authorities where appropriate.

Such action may be taken where there is suspected or actual:

• compromise;
• misuse;
• policy breach;
• legal or regulatory risk;
• threat to service integrity or availability; or

material risk to Computerko Limited, its customers, or third parties.
20. Relationship with other documents
This Information Security Policy should be read together with other applicable Computerko Limited documents, including:

• Privacy Policy, which explains how personal data is collected, used, and shared;
• GDPR / Data Protection Policy, which explains broader data protection governance;
• Acceptable Use Policy, which governs lawful and secure use of services;
• Support Policy, which explains support operations and boundaries;
• Cloud & Hosting Policy, which explains hosting and cloud service boundaries;
• Third-Party Services & Dependency Policy, which explains reliance on external providers;
• AI Policy, which explains AI-specific governance and limits;
• Warranty & Manufacturer Responsibility Policy, where relevant to devices and hardware; and
• any contract, quotation, SLA, service schedule, or service-specific terms that may apply.

If there is any conflict between this policy and a specific signed agreement or applicable contractual document, the relevant contractual document shall take precedence to the extent of that conflict.

21. Review and updates

Computerko Limited may update this Information Security Policy from time to time to reflect:
changes in threat landscape;

• changes in technology, infrastructure, or services;
• changes in provider arrangements;
• changes in business operations;
• legal or regulatory developments; and
• lessons learned from incidents, reviews, or operational experience.

Any updated version will be published with a revised date.

22. Contact

If you have any questions about this Information Security Policy, please contact:

Computerko Limited
27 Old Gloucester Street
London
WC1N 3AX
United Kingdom
Email: support@computerko.co.uk