Information Security Policy

Access control

Role-based, least-privilege access. Individual named accounts only — no shared credentials anywhere, for any reason, including "temporary" ones. Multi-factor authentication on email, platform admin and financial systems. Privileged access is restricted, logged and reviewed. Access is reviewed on every role change and revoked on the last working day, not "shortly after".

Passwords and secrets

Minimum complexity enforced by system policy · no reuse across systems · no passwords in email, chat, tickets or documents · API keys and credentials stored in the approved secret store, never in code repositories or configuration files committed to version control.

Endpoint security

Company-approved devices for client work · disk encryption · endpoint protection · automatic screen lock · OS and application patching within the stated window · USB storage disabled on data-handling campaigns · no unauthorised software installation.

Network

Segmented networks separating operational floors from general use · firewalls with a default-deny posture · VPN required for remote access to internal systems · no client work over public or unsecured networks · guest Wi-Fi separated from operational networks at every site.

Application and platform security

Environments separated (development / staging / production) · production data is not copied into development without masking · code review before production deployment · dependency and vulnerability scanning · security headers and transport encryption on all web properties · logging and monitoring on production systems · admin actions in platforms logged with the acting user.

Multi-tenant platforms — Akontec AI Support Operations, Omnetra BPO OS — enforce workspace data isolation so no tenant can access another tenant's data. This is a design guarantee, tested, not an access policy.

Physical security at delivery sites

Controlled entry · visitor register and escorting · CCTV covering operational areas · locked storage for any physical records · restricted printing with logging · secure destruction of paper · no personal devices at workstations on data-handling campaigns. Verified during onboarding (18_Vendors/02_Registration_And_KYC.md) and re-verified on audit.

Backups

Regular automated backups, encrypted at rest, stored separately from production. Restoration is tested on a stated cycle — an untested backup is an assumption, not a control, and the test is the only thing that proves the backup exists in usable form.

Vendor and third-party security

Security posture is assessed before any third party touches client data. Cloud and infrastructure suppliers are selected on their security controls. Contracts include security obligations, breach notification and audit rights.

Change management

Production changes are documented, reviewed, scheduled and reversible. Emergency changes are permitted for security fixes and are documented immediately afterwards, never skipped.

Monitoring and incident detection

Logs are collected and retained per 06_Document_Retention.md. Alerting on failed authentication patterns, privilege escalation, unusual data export volumes, and admin actions outside working hours.

Incident response

Any security incident follows the P1 route in 17_Support/03_Priority_Matrix_And_SLA.md and the breach response in 02_Data_Protection_Policy.md. Report first, investigate second.

Acceptable use

Company systems are for company work. No circumventing security controls, no unauthorised data extraction, no personal use of client systems, no connecting unapproved devices to operational networks.