Skip to main content
EAX Systems

Corporate governance

Governance is how we work, not a document we file.

This page describes our governance philosophy and operating practice. It is not a legal policy. Our published policies are available in Privacy, Terms, and the Trust Center.

Eight domains

What we govern, and how.

Each domain has an owner, a review cadence, and a written record. Where a limit exists, we state it rather than imply capability we do not have.

Risk

Risk is described in business language, assigned an owner, and reviewed on a fixed cadence rather than at incident time.

  • Engagement risk register maintained with the client sponsor
  • Technical risk raised with options and cost of delay
  • Decisions recorded with accepted residual risk

Compliance

We prepare organisations for examination by producing engineering evidence. We do not issue certifications, attestations, or regulatory approvals.

  • Control objectives mapped to implemented configuration
  • Evidence gathered as a by-product of delivery
  • Gaps stated plainly, with remediation sequence

Security

Security is an architectural property. Identity, protection, detection, and recovery are designed together and tested before scale.

  • Least privilege and segmentation by default
  • Logging and monitoring defined per workload
  • Recovery objectives agreed before production

Ethics

We decline work we cannot deliver responsibly, and we disclose limits of capability, availability, and partnership status without embellishment.

  • No claims of certification, endorsement, or client work we cannot evidence
  • Conflicts of interest declared before engagement
  • Product availability labelled honestly, including concept stages

Responsible AI

AI is introduced where the outcome can be evaluated and a human remains accountable for consequential decisions.

  • Documented use case, data boundary, and evaluation method
  • Human review retained for consequential outputs
  • Monitoring for drift, misuse, and unintended access

Privacy

Personal data is minimised, classified, and protected by design, with retention decided before collection.

  • Data inventory and classification early in delivery
  • Purpose limitation and retention agreed in writing
  • Access governed through identity, not convenience

Vendor management

Third-party technology is evaluated for security posture, operational fit, exit cost, and long-term support.

  • Concentration and exit risk assessed before selection
  • Contractual security and privacy obligations reviewed
  • Dependencies documented in the architecture record

Continuous improvement

Every engagement ends with a written review that changes our standards, templates, or reference architectures.

  • Post-engagement review with the client sponsor
  • Internal standards revised on a quarterly rhythm
  • Lessons folded back into the methodology

Stated limits

What we do not claim.

EAX Systems provides readiness, advisory, implementation, and alignment support. We do not issue certifications, attestations, or regulatory approvals.

Our only partner claim is verified membership in the Microsoft AI Cloud Partner Program. Microsoft product names are referenced descriptively.

Trust CenterPrivacy policy