AES-256 at rest, TLS 1.3 in transit, applied to every byte of client data without exception. AES-256 is the symmetric encryption standard adopted by the US Government for protecting classified information at the SECRET level and below; TLS 1.3 is the current Transport Layer Security version with forward secrecy and authenticated encryption. Coverage includes: engagement files, working documents, email attachments, archive storage, backup media, and the engagement ledger itself. Encryption keys are managed via the cloud provider’s key management service with rotation policies, audit logging, and access restricted to named technical leads. For high-sensitivity engagements (legal, healthcare PHI, capital markets material non-public information), client-managed encryption keys (BYOK) are available under the engagement letter.

72-hour client notification window from becoming aware of a personal-data breach, aligning with both GDPR Article 33 (controller notification window) and PDPA breach notification requirements. Breach response runs to a documented internal procedure: (1) Containment — immediate technical steps to limit scope; (2) Assessment — categorisation, affected data identification, harm assessment; (3) Notification — client notification within 72 hours, regulator notification support where required by the client; (4) Remediation — technical fix, access review, vendor escalation if vendor-side breach; (5) Post-incident review — root-cause analysis, process improvement, documentation update. Vendor sub-processor incidents trigger faster vendor-to-Othello notification (typically 24-48 hours per DPA) so Othello can meet the 72-hour client-facing window. The breach response procedure is documented and supplied to procurement reviewers under NDA.

Substantive work is Bangkok-managed throughout; technical storage is in the firm’s cloud environment with documented data residency. Bench-member working location is Bangkok — the no-outsourcing rule prevents substantive work from being routed through freelance pools, offshored to lower-cost jurisdictions, or processed via marketplace platforms. For cross-border transfers to client-side jurisdictions outside Thailand, the firm follows GDPR-aligned transfer mechanisms: Standard Contractual Clauses (SCCs) where applicable, adequacy decisions where applicable, derogations only with explicit client authorisation in the engagement letter. Cloud data residency can be configured per engagement — clients with regulatory requirements pinning data to a specific jurisdiction (EU residency, healthcare-specific) can specify in the engagement letter; the technical configuration follows.

Default retention is 90 days after engagement closure, then certified destruction. Longer retention applies where statutory hold requirements exist: Thai legal-sector retention rules, healthcare records retention, financial advisory work-paper requirements, legal-privilege documentation, capital markets working-paper requirements. Shorter retention is available on client request in the engagement letter — some clients prefer 30-day retention with destruction certificate issued shortly after closure; the firm accommodates with engagement-letter documentation. Destruction follows NIST 800-88 Clear/Purge guidelines: cryptographic erasure for encrypted storage, overwrite for non-encrypted, physical destruction for failed media. Destruction certificate available on client request as part of engagement closure. Backup-cycle data is destroyed on rolling schedule per the encryption pillar; no client data persists beyond the documented retention window plus the defined backup-cycle clearing period.

No client data is processed through public AI tools, free translation engines, or unmanaged third-party services. The no-outsourcing rule extends to algorithmic services: client data does not enter ChatGPT, free translation engines, public LLM APIs, or any service where the data could be used for model training or could be accessed outside the firm’s documented sub-processor list. Where AI-assisted tooling is used within bench work, it is through enterprise-grade contracts with documented data handling terms: no model training on client data, no retention beyond processing window, encryption in transit and at rest, full audit logging. The firm’s stance on AI tooling is documented in the engagement letter: if the client wants to restrict AI tooling entirely from their engagement, the restriction is implemented; if the client wants AI-assisted work, the specific terms are agreed. Bench credentials prioritise substantive technical and domain expertise over AI-augmentation — consistent with the firm’s substantive-over-performative positioning.

The current sub-processor list is documented internally and supplied to procurement reviewers under NDA on request. Typical sub-processor categories: enterprise cloud infrastructure (compute, storage), enterprise productivity suite (collaboration, documents), enterprise email and secure messaging, security tooling (endpoint protection, access management), and engagement-specific tooling where required (specialised translation memory tools, ESG reporting platforms). All substantive-content sub-processors operate under Data Processing Agreements aligned with GDPR Article 28 and PDPA Section 40; the firm’s standard DPA is non-negotiable on substantive terms (encryption, access controls, breach notification timeline, sub-processing disclosure, data return-or-destruction at end). Substantive changes to the sub-processor list are notified to active-engagement clients with reasonable advance notice, allowing the client to raise objection within the engagement letter terms.

Engagement-by-engagement documentation chain is maintained in the firm’s engagement ledger. Documented events per engagement: intake (timestamp, channel, file inventory, NDA status), access (named-user accesses, timestamps), processing (working document revisions, methodology decisions), transmission (delivery events, channels, recipients), retention (extension events, statutory hold flags), and destruction (certified destruction event, certificate identifier). The engagement ledger is the substantive procurement-grade audit-trail discipline inherited from the firm’s 2020 US Government contract origin — not a retrofitted commercial control but the practice the firm was founded operating under. The ledger is available to client procurement reviewers under NDA as part of vendor onboarding or post-incident review. Substantive material non-public information engagements (capital markets, healthcare PHI, legal-privilege-relevant) may have engagement-specific audit-trail enhancements documented in the engagement letter.

Othello does not currently hold ISO 27001 or SOC 2 Type II certification at firm level. The firm’s data-security posture rests on the GDPR + PDPA credentials documented at firm level, the FAR-grade contractor verification origin from US Government contracts, and the operationally documented controls described on this page. For clients with mandatory ISO 27001 / SOC 2 vendor requirements, the substantive sub-processors (enterprise cloud infrastructure, enterprise productivity suite) typically hold these certifications, and the firm’s DPA terms enforce the underlying controls regardless of certification status. Where a client requires a substantively equivalent attestation, the firm can provide its internal Information Security Policy under NDA, supplied with the sub-processor list and engagement ledger sample, for the client’s vendor-vetting review. The firm is open about what it holds and what it does not hold — honest scoping is the standing principle.

Access is revoked within one business day of bench-member departure, formally cycled through the firm’s access management system. No client data is stored on bench-member personal devices; all working is in the firm-managed cloud environment, so departure does not transfer any data physically off-firm. Departing bench members are subject to ongoing confidentiality obligations under the firm’s mutual NDA — the NDA is mutual (firm-bench), and the confidentiality obligation survives the bench engagement. For engagements with elevated sensitivity (capital markets MNPI, legal privilege, healthcare PHI), additional engagement-specific confidentiality terms apply documented in the engagement letter; bench members assigned to such engagements have specific exit procedures including written confirmation of returned/destroyed materials. The bench has been stable since founding 2020; bench turnover is low, and the documentation discipline supports a clean handover when departure does occur.

The vendor-vetting documentation set comprises four publicly accessible documents and three NDA-protected documents. Publicly accessible: this Data Security page (operational controls), Compliance Center at /compliance/ (regulatory regimes), GDPR + PDPA credential pages at /certifications/ (regulatory backbone), NDA Standard at /nda-confidentiality/, Privacy Policy, Terms of Service. Available under NDA on request: the firm’s Information Security Policy (internal operational policy document), the current sub-processor list (substantive vendors with DPA evidence), and an engagement ledger sample redacted to remove client-identifying information (demonstrating the audit-trail discipline). To initiate vendor-vetting: contact [email protected] with the procurement team’s vendor-onboarding requirements; the firm typically completes a full vendor-vetting documentation supply within 3-5 business days of NDA execution. For accelerated vetting (where the engagement scoping is time-sensitive), 1-2 business day completion is available on request. Founded 2020 on US Government bilingual contracts under FAR-grade contractor verification, the firm’s standing position is that procurement-grade documentation is a precondition for substantive engagement, not a friction to be minimised. Email [email protected] or call +66 02-859-2145.