Custodiance

The methodology

The Custodiance Standard

The operating standard behind every engagement, written down and applied consistently. It is what "built to your regulator's standard" means in practice: four principles, and a concrete mapping from each authority we work under to the way an estate is actually built.

Why it is written down

A website is something you buy once and worry about forever. Your digital estate is something a named expert holds and runs on your behalf: in UK and EU regions, to your regulator's standard, for as long as the engagement runs. You stop owning a problem and gain a custodian.

A posture that lives only in one engineer's head is not a standard; it is a habit. Custodiance publishes the standard so the way your estate is built is auditable, repeatable, and the same as the way the next one is.

The operating principles

Four principles, applied as the floor

These are not premium options behind a higher tier. They are the floor of every Custodiance engagement, simply what it means for us to run an estate at all.

Principle 01

Compliance-fluent by default

Your own regulator's standard is the floor of the build, written down in advance and applied from the first day of an engagement. It is never retrofitted once a problem appears, and never invoiced as a later add-on. Because the posture is documented rather than improvised, the way your estate is built is the way the next one is: auditable, repeatable, and defensible.

Principle 02

UK and EU data residency

Client data and hosting stay in UK and EU regions by design. Hosting regions are pinned in configuration rather than assumed, sub-processors are documented, and access is held to a known shortlist. Residency is not jurisdiction: a US-incorporated provider, such as Vercel or Cloudflare, can be subject to US law wherever the data sits, so each one is named as an exception rather than left out. When a regulator, a client, or your own board asks where your data lives and who can reach it, the answer is precise, exceptions included.

Principle 03

A named technical partner

One senior technical partner runs the estate: a name and a direct line, not a ticket queue or a rotating pool. That partner does the work between requests and is the person you speak to when something needs to be put right.

Principle 04

Maintenance as a continuous managed service

The estate is not a project that ends at launch. It is held and run for as long as the engagement lasts: monitored, patched, and kept to standard as obligations and threats move. A compliant build that is then left to drift is not compliant for long; custody means the posture is maintained, not set once and forgotten.

The mapping

What your regulator's standard means in practice

Each authority we work under translates into concrete infrastructure standards. This is how a regulatory obligation becomes a property of the estate rather than a clause in a policy document.

SRA

Law firms

Solicitors Regulation Authority

Confidentiality and client-money obligations carried into the infrastructure: UK and EU-resident hosting for client and matter data, enforced transport and at-rest encryption, access held to a named shortlist, and a documented sub-processor list, so the duty of confidentiality is a property of the estate, not a clause in a policy nobody can evidence.

ICAEW

Accountancy practices

Institute of Chartered Accountants in England and Wales

Client confidentiality and integrity of records reflected in the build: tamper-evident handling of client data, UK and EU-resident hosting and backup, controlled access to financial information, and a continuity posture that survives a vendor or hosting failure: the practice can answer where records sit and how they are protected.

KCSIE

Schools

Keeping Children Safe in Education

Safeguarding carried through to the public estate: appropriate handling and minimisation of any pupil or family data, UK and EU-resident storage, restricted access, and forms and contact paths built so a safeguarding concern reaches the right person, not a generic inbox. The web estate is treated as part of the safeguarding surface, not separate from it.

ICO / UK GDPR

Every regulated practice

Information Commissioner's Office (UK GDPR)

The data-protection regime engineered in rather than bolted on: lawful-basis-aware data capture, data minimisation by default, a maintained record of processing and sub-processors, working subject-access and erasure paths, and a DPIA where processing warrants one. Hosting is pinned to the UK and EU and every sub-processor is named with its country, so transfers do not become the unanswered question.

NTSELAT

Estate and letting agents

National Trading Standards Estate & Letting Agency Team

Material-information and transparency duties reflected on the public estate: fee and material-information disclosure surfaced correctly, accurate and current listings, and auditable handling of enquiry and client data in UK and EU regions, so the web presence meets the disclosure standard the regulator now expects rather than working against it.

NHS DSPT

Clinics and healthcare practices

NHS Data Security and Protection Toolkit

The DSPT control expectations carried into the web and email estate: UK and EU-resident hosting for any patient-adjacent data, enforced encryption, least-privilege access, monitoring and an evidenced incident path, and documented sub-processors, so the estate supports the practice's toolkit submission rather than becoming a gap in it.

In practice

What we do in every engagement

  • We build your estate to the standard this methodology sets out for your regulator, from the first day, rather than improvising per project.
  • We pin your estate's hosting and data stores to UK and EU regions, and name every provider in the path, with its country and its role, in a published sub-processor list you can hand to a regulator or client, US-incorporated providers included.
  • One named senior technical partner runs your estate: a name and a direct line, carried between requests.
  • We monitor, patch and update the estate as obligations change, for as long as the engagement runs, rather than setting it once and leaving it to drift.

This describes how we work. It is not a warranty that your practice is compliant: your regulatory obligations remain yours, and the terms of each engagement are agreed in writing. The sub-processor list is published at /sub-processors, and the agreement under which we process a practice's data at /dpa. Both carry a version and a changelog, and we sign the agreement with each practice.

Custody, not marketing.

Have a senior partner hold your estate to this standard

A scoping call is a measured conversation about your obligations, your current setup, and what it would take to run it to the standard above. No obligation, and no pressure.

Request a scoping call How it works