Trust, security & privacy.

This is the marketing and enquiry site for Quaesta Assurance Ltd, an ISO 27001, ISO 27701, and ISO 42001 consultancy based in the United Kingdom. The site exists so prospective clients can read about our services and start a scoping conversation.

We only collect information you choose to send through the contact form or the scoping assessment. That includes your name, work email, optional phone number and company, and the details you provide about your standards, timeline, and current maturity.

We use Google Analytics to understand aggregate visitor behaviour (pages viewed, referring source, approximate location, device type). IP addresses are anonymised and we do not run advertising trackers or cross-site behavioural profiling. You can opt out at any time using your browser's cookie controls or the Google Analytics opt-out tools.

• Form submissions travel over TLS to a server endpoint that validates and sanitises the input before storage.
• Enquiries are stored in a managed Postgres database with row-level security enabled. The table has explicit deny rules for anonymous and signed-in browser access — only trusted server code, acting under a service role, can read or write enquiries.
• Notification and acknowledgement emails are sent through Postmark using a server-side API key that is never exposed to the browser.
• Secrets (database credentials, email API keys) are stored as platform-managed environment variables and are not present in client-side code.

Enquiries are visible to authorised members of the Quaesta team for the purpose of replying to you and scoping any subsequent engagement. They are not shared with third parties for marketing.

• Supabase EMEA — application hosting and managed Postgres database for enquiry storage.
• Postmark — transactional email delivery for notification and acknowledgement messages.
• Google Analytics — aggregate, anonymised website usage analytics.

Subprocessors used inside a specific client engagement are listed separately in the relevant engagement contract, not here.

This site uses a small number of cookies. Strictly necessary cookies keep the site working — for example, remembering your cookie preferences and maintaining basic session state for the contact and assessment forms. These are set without consent because the site cannot function without them.

Analytics cookies are set by Google Analytics only after you accept them via the cookie banner. They help us understand aggregate visitor behaviour (pages viewed, referring source, approximate location, device type) with IP anonymisation enabled. We do not use advertising, retargeting, or cross-site tracking cookies.

You can withdraw or change your consent at any time by clearing this site's cookies in your browser, or by using your browser's built-in cookie controls.

Enquiry records are kept for as long as the relationship is active and for a reasonable period afterwards in line with UK record-keeping practice. If you would like your enquiry deleted, email hello@quaesta.co.uk and we will action it.

If you are in the UK or EU you have the right to access, correct, or request deletion of the personal information we hold about you, and to object to or restrict how we use it. To exercise any of these rights, email hello@quaesta.co.uk.

If you believe you have found a security vulnerability in this website, please email hello@quaesta.co.uk with the details. We will acknowledge receipt within two UK business days.

Please do not test against the live site beyond what is necessary to demonstrate the issue, and do not access, modify, or download data that does not belong to you.

Quaesta delivers ISO 27001, ISO 27701, and ISO 42001 engagements for clients. Any statement about Quaesta's own certification status will be made on the about page with the certificate number and certification body once available — never inferred from the contents of this page.