Trust

Trust Through Mathematics, Not by Contract

Ask most organisations why they trust a supplier with their data, and the answer, once unpacked, is a stack of paper. A contract with a confidentiality clause. A SOC 2 report. An ISO 27001 certificate. A data processing agreement. Perhaps a redacted penetration-test summary. Each of those documents says, in essence, the same thing: we promise to behave. Promises are not worthless. Commercial law exists, breach of contract carries consequences, and certification regimes do raise the floor of acceptable practice. But be clear-eyed about what a promise actually protects you from. A contract does not prevent a breach; it allocates liability after one. A certification does not stop an insider; it confirms that, at the time of audit, certain processes existed. Terms of service can be changed, acquired companies can be re-platformed, and well-intentioned suppliers can be compelled by courts or governments to do the very things they assured you they never would.