Show your working, not just your promises.
Audit cycles, regulator visits, client due diligence — all easier when the tech estate can answer for itself. We design controls that produce evidence, so you can show how things work rather than describe them.
- UK-based
- Sized to fit
- Talk to an engineer
Controls designed to produce proof — not a methodology document describing one.
Law firms, financial-services and wealth-management teams, and other compliance-heavy organisations need more than a responsive helpdesk. They need technical controls, records and escalation paths that survive client due diligence, insurer scrutiny, regulator questions and post-incident review. We've held that standard inside law firms for two decades — Gaby Hardwicke has trusted us for 22 years — and on estates where the bar is life-critical, like South East Coast Ambulance Service's 999 dispatch. The estate should answer for itself.
Built to answer the question before it’s asked.
Two halves of the same job: controls that produce evidence on demand, and the security posture that means there’s good news to evidence in the first place.
Evidence & assurance
Evidence by design
Access reviews, change records, backup posture and endpoint compliance captured continuously — produced as a by-product of running the estate, not assembled the week before an audit.
Audit-ready records
Logging, retention and configuration state held in a form an auditor or regulator can use directly. No reconstruction after the fact.
Due-diligence answers
The security posture and documentation a client questionnaire or insurer demands — ready to hand over, not scrambled together.
Continuous assurance
Posture scoring and drift detection so the evidence is current, not a point-in-time snapshot that's stale by the next quarter.
How we secure it
Identity-first security
MFA, Conditional Access, least privilege and privileged access management around the systems that hold sensitive and client data.
Managed detection & response
24/7 SOC and threat hunting across endpoint, identity and mail — containment before an incident becomes a notifiable one.
Incident readiness
Monitoring, escalation, containment and the written record a risk team needs when something has to be explained.
UK operating model
UK-based support, UK private-cloud options and UK data residency wherever the licensing allows.
- Cyber Essentials Plus
- IASME Cyber Assurance L2
- ISO 9001
- ISO 27001
- DBS-Enhanced — every employee
Where the estate has to answer for itself.
- LegalTwo decades inside law firms — confidentiality, case management and multi-site resilience, delivered against SRA and ICO expectations. Gaby Hardwicke has trusted us for 22 years.
- Financial services & wealth managementFCA-aware controls, evidence and data protection for firms handling client money and sensitive financial data.
- Life-critical & public servicesWhen the estate underpins 999 dispatch, the standard is 'doesn't fail.' South East Coast Ambulance Service runs on a platform we designed and still refresh.
- Charity & non-profitThe same threats and the same compliance pressure as larger organisations, met on leaner budgets and smaller teams.
M-Tech have consistently supported us as we have invested in our technology estate over the last twenty-plus years. They have a thorough understanding of this industry but more importantly they take the time to understand the business needs of their clients.
Posture & evidence review
A documented baseline — gap analysis against Cyber Essentials and the CAF, and an honest read on what evidence the estate produces today and what's missing.
Controls hardening
Identity, logging, backup and endpoint controls brought to a named standard that produces audit-ready evidence by default.
Transition & co-managed
Onboard alongside your internal compliance, COLP/COFA or risk function, working to whatever reporting cadence they need.
Managed with continuous evidence
Run to standard with monitoring, MDR and reporting a risk team can take straight into an audit or a due-diligence response.
Questions we hear from regulated-sector firms.
Are you used to working with FCA-regulated and legal firms?
Can you produce audit-ready evidence?
What accreditations do you hold?
Can you sit alongside our existing compliance or risk team?
Where does our data sit?
How quickly can you respond to an incident?
Let's make your estate answer for itself.
Book a discovery call. We'll review where your controls produce evidence today — and where a regulator, insurer or client would currently be told 'trust us'.