How I handle your information and use AI.

I take no referral fees, vendor commissions or reseller margin. You pay me for the advisory work we agree, and my recommendations are made in your interests.

I am the only person within Kennedy Advisory with access to engagement information. There are no other staff or associates reviewing your documents behind the scenes.

I organise each engagement’s work separately. The methods I use are reusable; confidential client material does not belong in shared instructions or templates.

I use AI to assist with research and analysis. I personally prepare, review and approve every client finding and recommendation. Responsibility for the advice remains with me.

Before work starts, we agree any specific restrictions on using AI with your information. If your organisation has particular requirements, raise them before sharing confidential material so we can agree a suitable approach.

My local working files and NAS backups are encrypted. Accounts used for the work are protected with multi-factor authentication, and my devices receive automatic updates.

• Encrypted working files
• Encrypted NAS backups
• Multi-factor authentication
• Automatic device updates

Access within the practice is restricted to me. These are statements about my own working arrangements, rather than the result of an independent security audit.

Retention and return or deletion arrangements need to be agreed before work starts. If you have a required retention period or deletion process, we will establish whether it can be met and record the agreed approach in the engagement terms.

Those arrangements need to cover working files, backups and relevant services, as well as any records that must be retained for legal or business purposes.

The engagement terms set out what I will assess and the work included. A readiness assessment is not a penetration test, a code audit or a legal opinion. Where a question needs specialist work beyond the agreed scope, I will flag it clearly.