Menu
No data was found
Whether you’re a one-person operation or a growing business with a full team, we’re here to help. Get in touch and let’s talk about what we can do for you.
Whether you’re a one-person operation or a growing business with a full team, we’re here to help. Get in touch and let’s talk about what we can do for you.
Nobody regulates how you handle client data. Your clients have started doing it instead.
Consultancies, agencies, architects, surveyors, recruiters and engineers all hold client information that matters, and unlike accountants or solicitors, you have no professional body telling you what good looks like. So the standards arrive another way: in a supplier questionnaire from your biggest client, in a security clause in a renewal, or in a question on your insurance proposal form. This page is about getting ahead of that, and about the question most firms genuinely can’t answer: where is all our client data, actually?
If you’re an accountancy practice or a law firm, we’ve written separately about accountants and legal professionals, because your regulators change the picture.
Nobody has ever told you what’s expected. There’s no handbook and no inspection. So most firms do something sensible, assume it’s enough, and find out otherwise at the worst possible moment, which is usually halfway through winning a contract.
You don’t know where your client data lives. This is the real one. Over a few years a firm accumulates a project tool, a file sharing platform, a CRM, an e-signature service, a time tracker, a couple of things somebody trialled and never cancelled, and now some AI tools. Most were signed up for with a card by whoever needed them. Client material is spread across all of it, and nobody has a list.
People and documents travel. Your team works at client sites, from home, on trains. Laptops get left places. Documents get emailed because it was quicker. The asset is mobile by design, which is a strength commercially and a problem for anyone trying to keep track.
And your insurance assumes you’ve done things you may not have done. Cyber and PI proposal forms ask direct questions about multi-factor authentication, backups and device management. An optimistic answer is a serious problem if you ever claim.
The firms that get caught out aren’t careless. They’re the ones where nobody’s job it was to check, because nothing ever forced the question.
Professional services firms are attacked through the ordinary routes: a mailbox without multi-factor authentication, a reused password, an unencrypted laptop. What makes it costly here is what you hold. Client strategy documents, commercial information, personal data gathered for a project, material covered by an NDA you signed. A breach isn’t just your problem, it’s immediately your client’s problem, and that conversation changes the relationship permanently.
The commercial cost arrives earlier and more quietly. Increasingly, security questionnaires are part of procurement. Firms lose work they never knew they were in the running for because an answer came back blank.
Done properly, this stops being a cost and becomes something you lead with. Know where your data lives, protect the accounts and devices properly, control who can reach what, and be able to evidence it. Then the client questionnaire is a form you fill in rather than a project you dread, and certification is something you mention in a pitch.
A proper look at the tools your firm uses, including the ones nobody told anybody about, so you know where client material is held, who can reach it, and what happens to it when a project ends or a person leaves.
Protected accounts and devices, controlled access, tested backup, and Cyber Essentials certification. Not just so you’re safer, but so the answer to a client’s security question is yes with a certificate attached.
We’ll explain what matters and what doesn’t in language you can take to a partners’ meeting. You should not need to understand the technology to make a good decision about it.
Two minutes, a handful of questions, covering the ground those forms actually ask about. Better to find the gaps now than during a procurement.
The deciding factor is commercial rather than technical. Cyber Essentials is increasingly what a larger client, a public sector buyer or a framework asks for before they’ll contract with you, and Professional includes the certification tools and support rather than leaving you to arrange it when a deadline is already live. It also gives you the strongest security stack we offer, which is proportionate for a firm holding client commercial information under NDA.
For a small firm or a sole consultant, Essential covers complete cloud and email security, real Microsoft 365 backup, device security and your Microsoft 365 Business Premium licence.
Either way, the first job is the same and it’s the interesting one: working out what you’re actually running and where client data sits. That conversation tends to surprise people.
The Professional IT Support Service is for businesses that want the best — complete IT support, the strongest security we offer, and Cyber Essentials tools and certification support all in one package. If you need to protect your reputation, meet compliance requirements, and have confidence your IT is in safe hands, this is it.
Key Features
Every package is unlimited support with no ticket caps and no per-incident charges. Rolling monthly terms are available, longer terms carry a discount, and not-for-profit pricing applies across the range. Current prices are on the package pages.
Including the ones on somebody’s personal card. This is the foundation and almost nobody has it.
Senior people are the most targeted and the most likely to ask for an exemption.
Your team works away from the office by design. A lost unencrypted laptop with client material on it is a conversation with that client, not just an equipment cost.
Not just email. Every tool on that list, plus any files sitting in a personal account.
Your team is already using them. A simple, written statement of which tools are approved and what must never be pasted into one protects you commercially and answers a question clients are starting to ask.
Which means knowing what’s true. We’ll tell you, including when the answer is uncomfortable.
This is the part that stops most people, and it’s usually smaller than imagined.
Systems, tools, devices, accounts, where client data lives and who can reach it. About an hour, no obligation, and the findings are useful on their own.
Multi-factor authentication, device protection and access control, which between them cover most of what a questionnaire or an insurer asks about.
Where Cyber Essentials would open doors commercially, we’ll take you through it. Where it genuinely wouldn’t, we’ll say so.
Unlimited support Monday to Friday, 9am to 5pm, monitoring and patching through the week, and documentation kept current so the next questionnaire is an hour’s work.
Questions professional services firms ask us
Very common, and one of the main reasons firms call us. We’ll go through it with you, tell you what’s actually true today, fix what needs fixing, and give you accurate answers. What we won’t do is help anyone answer optimistically, because that creates a much worse problem later.
In some markets clearly yes, particularly public sector, larger corporates and anything with a procurement process. In others it’s a tie breaker rather than a requirement. We’ll give you an honest read on your market rather than selling it as universally essential.
Worth getting in front of, yes. The risk isn’t the technology, it’s pasting confidential client material into a tool nobody has checked, often in breach of an NDA your firm signed. A short written policy and a decision about which tools are approved covers most of it, and it’s increasingly something clients ask about directly. There’s more on our AI consultancy pages if you want to go further.
It’s normal and it’s manageable, but it does need mapping. The issues are usually practical rather than dramatic: nobody knows what’s being paid for, client data sits somewhere unexpected, and when a person leaves their accounts go with them. Sorting it out often saves money as well as risk.
Which is why devices matter more in your sector than in most. Managed, encrypted and supported wherever someone is working, with the same access rules in a client’s meeting room as in your office.
A fair question and one most firms answer badly, usually by keeping everything forever. Worth having a position on retention, both because clients ask and because holding data you no longer need is pure risk.
We don’t work to fixed SLA response times. Within our working hours, Monday to Friday, 9am to 5pm, we work on priority, so something stopping the firm from delivering is dealt with ahead of something trivial.
No. You can take any package on a rolling monthly term. Longer terms carry a discount, and the current rates are on each package page, but that’s your choice, not a condition.
We look after consultancies, agencies, architects, surveyors and other professional firms across Bristol, Bath, Cheltenham, Gloucester, Somerset and Swindon, with remote support anywhere in the UK. We’re an NCSC Assured Service Provider, Cyber Essentials Plus certified, and ISO 9001 and ISO 27001 accredited, which is usually what a client’s own due diligence is checking for in a supplier.
Start with an hour working out where your client data actually lives. You’ll have the answer whether or not you work with us, and you’ll want it the next time a client asks.
We have worked with a number of IT providers in our 9 years of business, but were always disappointed with the responsiveness and level of service.
Meraki HR is an HR Consultancy business and we pride ourselves on the level of support and service we offer to our clients and wanted to find an IT provider who provided a great service.
We moved to Do Your IT over 3 years ago, and what a difference! They are responsive, helpful and really do get the extra mile to help you resolve any IT issue you may have.
Emma Browning – MD and Owner of Meraki HR