Policies
How this website handles your information, the terms it’s offered under, and how we handle security. Written plainly, because we sell compliance work and it would be strange not to.
A note on this page
These policies were rewritten in 2026 to describe what this website actually does. They are accurate as written, and they are pending review by counsel. If anything here is unclear or you believe it is wrong, tell us at [email protected] and we will correct it.
Privacy Policy
The short version: this website collects nothing about you unless you fill in the contact form. There is no analytics, no advertising, and no tracking.
What we collect
If you submit the contact form: your name, phone number, email address, and whatever you write in the comments field. That form is hosted by monday.com, which is our customer relationship management system. Your submission goes to monday.com and is processed there under monday.com’s own privacy policy, and it reaches us as a record in our CRM.
If you email or call us: whatever you choose to tell us, kept in the way any business keeps correspondence.
Otherwise, nothing. Browsing this site does not require you to identify yourself.
What we deliberately do not do
- No analytics. We do not run Google Analytics, Google Tag Manager, or any other analytics or measurement script.
- No advertising or third-party tracking. There are no advertising pixels, retargeting tags, or social tracking scripts on this site.
- No cookies set by us. This website sets no cookies of its own. The embedded monday.com form may set cookies within its own frame; that is monday.com’s processing, described in their policy.
- No third-party fonts. Our typeface is served from our own domain rather than from Google Fonts, so loading a page does not send your IP address to a font provider.
- No selling or sharing. We do not sell, rent, or trade your information, and we do not build or maintain any database of contacts sourced from the web or from third parties.
Third parties this site touches
Two, and only when you choose to interact with them:
- monday.com — hosts the contact form embedded on this site and stores the enquiries we receive.
- Freshdesk — our support portal, reached only through a link, for existing clients.
Everything else that points off this site — social networks, a video on YouTube, a partner’s website — is an ordinary link. Nothing loads from those services until you choose to follow the link, at which point their terms apply, not ours.
Why we hold it, and for how long
We use what you send us to answer your enquiry, to carry out any engagement that follows from it, and to keep the business records a consulting firm is expected to keep. We keep enquiries for as long as they remain relevant to a live or prospective engagement, and client records for as long as our professional and legal obligations require.
Your rights
You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live, you may have specific statutory rights to do so. Write to [email protected] and we will respond.
Children
This site is aimed at organizations and the people who run them. It is not directed at children, and we do not knowingly collect information from them.
Changes
If we change how this site handles information, we will change this page. There is no version history published here, so if the distinction matters to you, take a copy.
Terms of Use
What this website is
A description of the services C'S|3 Consultancy Corp offers, and a way to get in touch about them. Nothing on this site is an offer, a contract, or professional advice. Engagements are governed by a signed engagement letter, and nothing here varies one.
Not professional advice
The material here about SOC 2, HIPAA, information security, financial audit, and organizational assessment is general description. It is not legal, accounting, audit, or security advice, and it should not be relied on as a substitute for advice about your specific circumstances. Statistics and framework descriptions are drawn from the issuing bodies and are current to the best of our knowledge; frameworks change.
Trademarks and third-party material
The Strength Deployment Inventory and SDI 2.0 are products of Core Strengths, with whom we partner. The Organizational Culture Assessment Instrument (OCAI) is © Kim Cameron. SOC 2 is an AICPA framework. Other framework names, client names, and logos on this site belong to their respective owners and appear here to describe our work, not to imply endorsement beyond what a named testimonial states.
Our content
Text, design, and images on this site are ours unless attributed otherwise. You are welcome to quote us with attribution. You may not reproduce the site wholesale or present our material as your own.
External links
We link out where it is useful. We do not control those sites and are not responsible for what they contain.
Security
We advise other organizations on their security posture, so it is fair to ask about ours.
This website
The site is static. There is no database behind it, no login, no user accounts, and no server-side code processing your input — which removes most of the categories of vulnerability a marketing site normally carries. The only data entry point is the embedded monday.com form, which submits directly to monday.com rather than to us.
Client information
Assessment work necessarily means handling sensitive information about our clients’ systems, controls, and people. How that information is handled, stored, and destroyed is set out in the engagement letter for each engagement, and we are content to have that conversation before you sign anything.
Where an engagement involves protected health information, the handling of that information is governed by a business associate agreement.
Reporting a vulnerability
If you believe you have found a security problem in this website or in something we operate, please tell us at [email protected]. Tell us what you found and how to reproduce it. We will acknowledge you, and we will not pursue anyone who reports in good faith and does not access, alter, or destroy data belonging to others.
Questions about any of this?
Write to [email protected] or call 719-204-3101. C'S|3 Consultancy Corp, 2910 N. Powers Blvd., Colorado Springs, CO 80922, USA.