Multi-factor authentication
Required on all Neurosuite accounts and on every client account provisioned for our consultants. Where your tenant enforces conditional access, we comply with it.
Trust
Security, privacy and the remote delivery model
Remote work inside your ERP is a responsibility we take seriously. This page describes, in business language, the controls we apply as standard on every engagement, the measures we configure per client, and how access, information handling and incidents are managed from start to finish.
Applied as standard
Controls on every engagement
These are our baseline. They are not optional and they do not depend on the size of the engagement.
Least-privilege access
Named accounts, never shared. Roles limited to what the scope needs (for example, no global administrator rights for application support). Requests for additional access are made in writing and recorded.
Access logging and periodic reviews
Access to client environments is logged on both sides. We review assigned accounts periodically and at every change of assignment, and ask you to confirm removals.
Limited local data copies
Work happens inside your systems or the agreed virtual desktop. Local copies of client data are avoided; where a copy is unavoidable for a task (for example, a data migration file) it is minimised, protected and deleted afterwards, as documented.
Vetted, employed consultants
Consultants are employed by Neurosuite Ltd, bound by confidentiality obligations, trained on client information handling and supervised by senior staff. No anonymous subcontracting.
Secure devices and networks
Managed devices with disk encryption, current patches and endpoint protection, used from the Ibadan hub's controlled office network or an approved secure connection.
Agreed per engagement
Measures selected and configured for your environment
These depend on your systems, data and policies. They are proposed during onboarding, agreed with you and written into the agreement, so the delivery approach is explicit rather than assumed.
EU-hosted virtual desktop environment
Where selected and configured for the engagement, consultants work through a virtual desktop hosted in the EU (in your tenant or ours), so data and sessions stay within that environment. We recommend it for engagements involving personal or commercially sensitive data.
Client agreements
Services agreement with Neurosuite B.V., confidentiality terms and a GDPR data processing agreement where applicable, using your templates or ours.
Cross-border transfer safeguards
Where personal data is accessed from Nigeria, the appropriate safeguards (standard contractual clauses, transfer impact considerations and technical measures) are agreed and documented before access is granted.
Your tooling and policies
Privileged access management, conditional access, DLP and logging requirements of your organisation are adopted and written into the onboarding pack.
Access lifecycle
From provisioning to revocation
- Access provisioning
- You create named accounts in your environment to our written specification (role, scope, MFA). We confirm receipt and test access before any work begins. Nothing is provisioned on a verbal request.
- Information handling
- Client information is used only for the engagement, stored in the agreed systems, classified where you require it, and never shared with third parties without written permission.
- Change and release control
- Changes to your systems go through the agreed workflow: ticket, sandbox or test environment, test evidence, approval, then production. Emergency changes follow a documented exception path.
- Access revocation
- When an assignment ends, a consultant leaves or the contract closes, we request removal of access the same day and confirm it in writing. Periodic reviews catch anything missed.
- Incident communication
- Security incidents, suspected or confirmed, are reported to your named contact without undue delay with the facts known at the time, followed by containment, root-cause analysis and corrective actions in writing.
- Responsibilities
- You remain the controller of your data and the owner of your systems; we act on your instructions within the agreed scope. The division of responsibilities for infrastructure, identity, backups and application changes is written into every service description.
Assurance
Certifications, audits and questionnaires
Details of the certifications, audit evidence and compliance status relevant to your engagement are shared on request during the proposal stage, together with answers to your security questionnaire. We prefer to show evidence for your specific scope rather than print generic badges on a web page.
Privacy at a glance
- Neurosuite B.V. is the contracting entity and, for client personal data, acts as processor under the GDPR
- Neurosuite Ltd processes data under the Nigeria Data Protection Act 2023 and the agreed transfer safeguards
- Website enquiries are used only to respond and prepare proposals; see the privacy notice
- No advertising cookies; analytics only with consent, see the cookie notice
Frequently asked questions
Does our data leave the EU?
Work is performed inside your systems. Where an EU-hosted virtual desktop is selected for the engagement, consultants at the Ibadan hub work through that desktop and data stays in the EU-hosted environment. Where you choose direct access instead, consultants access your cloud tenant from Nigeria through named, MFA-protected accounts; the applicable cross-border transfer safeguards (for example, standard contractual clauses in the data processing agreement) are agreed before access is granted. We document the chosen model in the agreement so there is no ambiguity.
Which agreements do you sign?
A services agreement with Neurosuite B.V., a confidentiality agreement, and, where personal data is processed, a data processing agreement under the GDPR including transfer safeguards. We can work from your templates or ours.
Who can see our data?
Only the named consultants assigned to your engagement, with the roles agreed at onboarding. Access is logged, reviewed periodically and removed when an assignment or the contract ends. Leadership in the Netherlands has oversight responsibility but does not access client data without need.
What happens in a security incident?
We notify your named contact without undue delay, share what we know, contain the issue together with you, and document the root cause and corrective actions. Timelines for notification are written into the data processing agreement.
Are you certified?
Details of certifications and audit evidence relevant to your engagement are provided on request during the proposal stage, where we can also answer your security questionnaire. We describe controls on this page as what we apply as standard and what is configured per engagement, rather than making generic claims.
Can you work within our own security tooling?
Yes. Many clients provide a virtual desktop, privileged access management or conditional access policies of their own. We work within them and document the arrangement.
Discuss the delivery model for your environment
Every client environment is different. A discovery call is the quickest way to agree which controls apply, which measures we configure for you, and what the onboarding pack will contain.