Security Policy

Access Control

User roles and permissions are defined based on job responsibilities. We enforce the principle of least privilege — no personnel receive access beyond what is necessary for their function.

• Multi-factor authentication (MFA) required for all administrative access
• Regular review and evaluation of permission levels across all systems
• Server-level restrictions enforce direct access controls on critical infrastructure
• Access logs maintained and reviewed for anomalous activity

Data Protection

All sensitive data in transit is encrypted using SSL/TLS. Sensitive data at rest is encrypted within our databases. We maintain strict data lifecycle procedures with ongoing surveillance for unauthorised access patterns.

• SSL/TLS encryption for all data in transit
• Encryption at rest for all sensitive database records
• Data lifecycle management with automated expiry controls
• Continuous monitoring for unauthorised access attempts

Vulnerability Management

We regularly scan the platform for vulnerabilities using reputable security tools. Software components — including web servers, plugins, and other dependencies — are promptly patched and updated. A documented remediation process addresses emerging threats systematically.

• Automated vulnerability scanning on a regular cadence
• Prompt patching and version updates for all software components
• Documented process for systematic remediation of emerging threats
• Dependency tracking to identify and resolve supply-chain vulnerabilities

Secure Development

All engineering follows secure coding practices with mandatory code reviews. Sensitive values — including keys and credentials — never appear in source code. Input validation protects against cross-site scripting (XSS), and parameterised queries prevent SQL injection.

• Secure coding standards enforced across all development teams
• Mandatory code review process for all production changes
• Parameterised queries to prevent SQL injection
• Input validation and output encoding against XSS
• Secrets management — credentials never stored in source code

Security Monitoring

We deploy intrusion detection systems and analyse system activity for suspicious patterns through real-time alerting. Our security operations team reviews alerts continuously and responds to events under defined SLAs.

• Intrusion detection systems (IDS) deployed across infrastructure
• Real-time alerting for anomalous activity patterns
• Centralised log aggregation and analysis
• Defined SLAs for incident acknowledgement and response

Incident Response

A formal incident response plan outlines the steps to take in case of a security breach. A designated response team with clear roles and responsibilities is maintained and regularly tested through tabletop exercises and simulations.

• Documented incident response plan with clear escalation paths
• Designated response team with defined roles and responsibilities
• Regular drills and tabletop exercises to test preparedness
• Post-incident reviews and lessons learned process
• Breach notification procedures compliant with FADP requirements

Physical Security

Server infrastructure is housed in secured facilities with controlled access and appropriate environmental safeguards including fire suppression, redundant power, and climate control. Physical access to critical systems is logged and restricted to authorised personnel only.

Staff Education

All staff receive regular security awareness training addressing threat recognition, phishing and social engineering defence, credential management, and information protection. Security training is mandatory and tracked for completion.

Third-Party Integrations

We evaluate the security posture of all external service providers before integration and maintain ongoing oversight of integrated tools. Third-party security reviews are required for any service handling sensitive data or accessing production systems.

• Pre-integration security assessments for all third-party services
• Contractual security requirements for vendors and partners
• Ongoing monitoring of third-party security advisories
• Least-privilege API access for all external integrations

Audits & Assessments

We conduct periodic security assessments and audits to identify potential weaknesses. Third-party security professionals are engaged to perform penetration testing and code reviews on a regular basis.

• Periodic internal security assessments
• Annual third-party penetration testing
• Code audits for critical platform components
• Compliance reviews against FADP, AMLA, and FINMA guidelines