1. Who we are
Belton IT Nexus Limited is a privately held, New Zealand-owned and operated managed IT, cyber security and AI services firm, founded in 2004 and headquartered at Level 3, 101 Carlton Gore Road, Newmarket, Auckland. We serve 469 organisations across New Zealand and Australia with a 40-strong in-house team.
2. Standards alignment
Belton's controls and client deliveries are aligned to ISO/IEC 27001 principles and mapped to the ACSC Essential Eight. We state this precisely: alignment and mapping, with evidence, not certification. Client environments are configured, documented and reviewed against these frameworks, and the supporting evidence is maintained in our client platform so it can be produced for boards, insurers, auditors and enterprise procurement.
3. Vendor and platform assurance
We run client workloads only on independently audited platforms. The vendor stack behind our delivery holds certifications including SOC 2 Type II, ISO/IEC 27001/27017/27018/27701, FedRAMP, IRAP, Common Criteria and FIPS 140-2 validation, held at the vendor level and documented per platform on our accreditations page. Vendors that cannot evidence their controls do not run our clients' environments.
4. Data residency and sovereignty
Client data residency is determined per workload and documented. Where data must remain onshore, we operate sovereign data-centre capacity in Auckland and Christchurch (New Zealand) and Sydney, Melbourne, Brisbane and Perth (Australia), with international data-centre operations in Singapore, Germany, the Netherlands and the USA where reach is required.
5. Security operations
- 24/7 security operations capability through our global SOC partner network.
- Managed endpoint detection and response (EDR) across client fleets.
- Multi-factor authentication and conditional access enforced as default posture.
- Email security beyond platform defaults, tuned for phishing and payment-redirection fraud.
- Encrypted backups with scheduled, tested restores and agreed recovery objectives.
6. Privacy
We handle personal information in accordance with the New Zealand Privacy Act 2020 and, for Australian clients, the Privacy Act 1988 (Cth) including the Australian Privacy Principles and the Notifiable Data Breaches scheme. We do not publish client names or identifiable client details; references are available on request with client consent.
7. People and process
Clients are served by named pods with a dedicated account manager, backed by specialist cyber and operations teams. Access to client systems follows least-privilege principles with MFA enforced. Our delivery process (Discover, Map, Protect, Improve) produces documented environments: no tribal knowledge, no black box.
8. Incident response
We maintain incident response procedures covering detection, containment, client notification, recovery and post-incident review. Critical incidents carry a 15-minute response target in business hours, with 24/7 emergency cover on extended agreements (standard support Mon–Fri 8:30am–5:00pm, extended 6:30am–11:00pm NZT).
9. Transparency
Clients receive live visibility of their environment, controls and compliance posture through the Belton Client Portal, the same picture our team works from. Recommendations carry written reasoning; renewals are never silent; product margin is fair and disclosed as our model.
10. Verification
Specific control detail, vendor certificates and client-environment evidence are available under NDA for genuine due diligence. Contact [email protected] or +64 9 974 2379.
Issued June 2026 · supersedes earlier statements · reviewed annually or on material change
