Security Policy

1. Security Approach

We protect the confidentiality, integrity and availability of our systems and data using a risk‑based approach aligned with industry good practices.

2. Technical & Organisational Controls

• Encryption: TLS for data in transit; encryption at rest for sensitive data with our providers.
• Access control: Role‑based access, least privilege, and multi‑factor authentication for admin systems.
• Secure development: Change control, code review, and dependency management.
• Vulnerability management: Regular patching and security updates.
• Logging & monitoring: Activity logs and anomaly detection.
• Backups & resilience: Provider‑managed backups and high availability where applicable.
• Awareness: Staff training on data protection and security practices.

3. Third‑Party Providers

We vet vendors for security, confidentiality and data protection. Where data leaves the UK, we use appropriate transfer safeguards (e.g., IDTA/SCCs).

4. Incident Response

We operate an incident response process to assess, contain and remediate security events. Where required, we notify affected users and the ICO without undue delay.

5. User Responsibilities

• Use strong, unique passwords and keep credentials confidential.
• Enable multi‑factor authentication where available.
• Report suspected security issues to us immediately.

6. Security Contact

Report a security concern: business@cyberpathinsight-uk.com | Tel: +44 730 999 6080.