Security
Security and data practice are group standards, not per-project decisions.
Data is encrypted in transit and at rest, and never sold. Access, review and incident practice are held to one bar across the portfolio.
As the group takes on regulated activity, this is the layer that has to be right first.