Security, privacy and quality you can evidence.

Evara is the trading name of Inbound FinTech Limited, a company registered in England and Wales under company number 06020663, incorporated in December 2006. Our office is at 100 Bishopsgate, London EC2N 4AG. Our ISO certificates are issued to Inbound FinTech.

Yes. Evara is certified to ISO/IEC 27001:2022 (certificate 255209) by the British Assessment Bureau, part of Amtivo, under UKAS accreditation. We were first certified on 7 June 2024; the current certificate was issued on 3 July 2026 and is valid until 6 June 2027, subject to annual surveillance audits.

Yes. Evara is certified to ISO 9001:2015 (certificate 251673) by the British Assessment Bureau under UKAS accreditation, with the same scope and validity dates as our ISO 27001 certificate. Both standards run as one Integrated Management System.

Both certificates cover the provision of growth systems consultancy, technology implementation, CRM architecture, smart lead generation, SEO and Answer Engine Optimisation (AEO), data and business intelligence, AI and automation, revenue operations, and strategic advisory services for Financial Services and FinTech organisations globally.

Our second surveillance audit took place in June 2026 with zero non-conformities; the auditor sampled 17 Annex A controls and found all conformant. Our first surveillance audit in June 2025 also had zero non-conformities. We also run an annual full-system internal audit with an external consultancy.

Yes, under NDA. Our Statement of Applicability (v1.0, June 2026) applies 92 of the 93 ISO/IEC 27001:2022 Annex A controls, with one control excluded and justified as not relevant to our services. Email us to request the summary.

No. As a UK consultancy we certify to ISO/IEC 27001:2022, which is independently audited every year and covers a comparable range of controls. The core platforms we rely on, such as HubSpot and Google Workspace, hold their own SOC 2 and ISO 27001 attestations.

We do not currently hold Cyber Essentials certification. Our ISO/IEC 27001:2022 certification covers the Cyber Essentials technical areas (secure configuration, access control, malware protection, patching and boundary protection) and we can provide a control mapping on request.

Yes. MFA is mandatory on every platform, access route and privileged account, with no exceptions. We use single sign-on wherever a platform supports it.

Access is role-based and least-privilege, granted through a controlled request process. Every user has a unique named account and shared accounts are not permitted. Privileged access needs written approval and is reviewed at least every six months.

Leavers’ access is disabled by the end of their last working day, devices and assets are recovered, and confidentiality obligations are restated. Movers have their access reset to their new role.

All company devices are centrally managed, with full-disk encryption, endpoint protection, remote-wipe capability and a screen lock after 10 minutes of inactivity. High and critical security patches are applied within 14 days, and unsupported operating systems are not permitted.

Yes. Data is encrypted in transit using TLS and at rest within our cloud platforms, and every company device uses full-disk encryption. Confidential information is only ever transferred through encrypted channels.

Our public-facing infrastructure undergoes external security assessments at least annually, and twice in the past year. The latest assessment of evara.co, in May 2026, found no high or critical issues. A summary of scope and outcome is available under NDA.

Yes. Administrative activity across our core platforms is logged, retained for six months and reviewed monthly by our InfoSec team. Relevant logs can be shared with clients on request during an investigation.

We do not operate our own software products that host client data. Where we build on your platforms, such as HubSpot CMS modules, integrations or automations, code is peer-reviewed, version-controlled, kept free of secrets and tested before release. Client personal data is never used in test environments.

Significant changes are risk-assessed, approved, communicated in advance and logged under our Change Management Procedure, with a fall-back plan. Changes in client systems are agreed with the client before release.

Through HubSpot Partner access that you grant directly. Each Evara specialist uses a named user with MFA, partner users do not consume your paid seats, and you can change or remove our permissions at any time.

Only the permissions the agreed work requires. We request the minimum set at kick-off, ask for elevated rights only for specific tasks, and remove access when the engagement ends.

Partner users usually need to be excluded from your portal SSO because they authenticate through their own HubSpot accounts. MFA remains mandatory for every Evara user, as our ISO 27001 controls require.

Not unless you instruct us to. We work inside your portal, and any exports needed for a task are kept to the minimum, held in restricted project folders and deleted when no longer needed.

Credentials you issue to us are stored in our enterprise password manager, never in code, email or documents, and are scoped to the integration they serve. We ask you to rotate or revoke them at the end of the engagement.

For client data we are a processor: we act only on your documented instructions under a data processing agreement and do not use or retain your personal data for any other purpose. We are a controller only for our own business and marketing data.

Yes. Our DPA includes UK GDPR Article 28 terms covering instructions, confidentiality, security, sub-processors, assistance with rights requests and breaches, deletion or return, and audit. We are also happy to review yours.

Client CRM data remains in your own platforms and the hosting region you have chosen. Our own working data is held in our core cloud platforms. The hosting region and transfer safeguard for every sub-processor is set out in our register, available on request.

Some of our technology providers are headquartered outside the UK. Where a restricted transfer occurs, it is covered by a recognised safeguard such as the UK International Data Transfer Agreement or Addendum, or a UK adequacy decision. Details are in our sub-processor register.

Only as long as the engagement requires. Our retention register sets defined periods for each record type, and at the end of a contract client data is returned or securely deleted as set out in the DPA.

Yes. We have documented procedures for supporting access, rectification, erasure and objection requests relating to data we process for you, and will support your DPIAs where our services are involved.

Yes. Inbound FinTech Limited, trading as Evara, is registered with the Information Commissioner’s Office under registration number ZA370337.

Evara has had no reportable personal data breaches and no regulatory enforcement action.

Security events are triaged within eight hours of being reported. If an incident affects your data or services, we notify you without undue delay so you can meet your own regulatory deadlines, and we notify the ICO within 72 hours where we are required to.

Yes. Our ICT Continuity Plan is based on a business impact analysis, sets recovery time objectives for each critical system, and is exercised every year. Our latest exercise ran on 17 May 2026 and completed successfully.

Restoring cloud data through version rollback is immediate. Replacing a compromised laptop takes 24 hours, moving fully to remote working takes 24 hours, and migrating to an alternative provider takes one week. Your HubSpot data is protected by HubSpot’s own resilience.

Engagements are delivered by teams, not individuals. Work is documented in our project system and shared drives, so another specialist can pick it up without losing context.

Yes. We carry out pre-engagement screening proportionate to the role, including identity, employment history and qualification checks. Specialist contractors are vetted and bound by the same confidentiality and security obligations as employees.

Yes. Everyone completes security awareness at induction, cyber security training within 30 days of joining and every year after, plus ISO 27001, ISO 9001 and GDPR awareness. Completion is tracked. Anti-money laundering and anti-bribery training are also mandatory.

Yes. Confidentiality clauses are in every employment and contractor agreement, and everyone acknowledges our Acceptable Use and Information Security policies before they get access to systems.

Our core platforms are listed in the sub-processors section of this page. The full register, including hosting regions and transfer safeguards, is available on request, and we notify clients before adding a sub-processor that will handle their personal data.

Every supplier is risk-assessed before onboarding and reviewed annually under our Supplier Control Policy. We prefer ISO 27001 or SOC 2 certified providers; others must complete our security questionnaire. Contracts cover confidentiality, audit rights, incident notice and data return.

Yes, to speed up analysis, research and drafting, using business-grade tools whose terms exclude customer data from model training. Every output is reviewed by an Evara specialist, and we will deliver without AI if your policies require it.

No. We only use AI tools under terms that exclude customer data from model training, and we avoid putting personal data into prompts wherever possible.

Yes. We regularly complete supplier reviews for FCA-regulated firms and can support SYSC 8 and PRA SS2/21 requirements, including audit and information rights, continuity evidence, sub-outsourcing controls and exit planning.

For EU-regulated clients we can agree the DORA Article 30 contractual terms, including service descriptions, data processing locations, incident assistance, termination rights and exit strategies.

Yes. We support remote audits and reasonable on-site audits by clients, their auditors and their regulators, subject to confidentiality and reasonable notice.

Evara is not FCA-authorised and does not approve financial promotions. Content and campaigns for regulated firms go through your nominated approver before publication, and we keep version records to support your sign-off.

We hold professional indemnity, public liability and employers’ liability insurance. Certificates are available on request.

Yes. We have an Anti-Bribery and Corruption Policy aligned with the UK Bribery Act 2010, an Anti-Money Laundering Policy with sanctions screening, and an Anti-Slavery and Human Trafficking Policy. We are below the turnover threshold for a statutory modern slavery statement.

Yes. This page answers the most common questions, and we keep a pre-completed standard questionnaire ready to share. For bespoke questionnaires, email us and we will turn it round as quickly as we can.