Policy summaries
The policies below were approved by top management on 7 October 2026. The next review is due by 7 October 2027. Approval makes them company policy. It is not an audit, and the full text is not posted here. Each summary says what the policy is for.
| Policy | What it covers |
|---|---|
| Information security | The intent of the program, the roles, and the rule that we do not claim a standard we have not been audited against. |
| ISMS and document control | How security documents are approved, reviewed, and kept current. |
| Information classification and handling | How information is classed and how each class is handled. |
| Access control | How access to the product and to company systems is granted and limited. |
| Acceptable use and asset management | What people with access may do, and how assets are tracked. |
| Physical and environmental security | Remote work, clear desk, and media. We do not run our own data center. |
| Human resources security | Joining, working, and leaving. |
| Cryptography and secrets | Encryption in transit and at rest, and how secrets are stored. |
| Communications and network security | The edge path, browser headers, and the fact that there is no separate corporate network to describe. |
| Secure development | How the product is designed, built, and reviewed. |
| Change management | How a change is proposed, reviewed, and shipped. |
| Vulnerability and patch management | How weaknesses are found, triaged, and patched, and how external reports are taken. |
| Logging, monitoring, and alerting | What is written down when the system changes, and how those records are kept. |
| Incident response | How an incident is classed, who is called, and how it is closed. |
| Business continuity and disaster recovery | How the service is expected to be recovered. |
| Vendor and third-party risk | How subprocessors are added, reviewed, and removed. |
| Data protection and privacy | How personal data is handled inside the company. The public notice is the privacy policy. The customer agreement is the DPA, on request. |
Documents available on request
These are not posted on this site. There is no portal. Write to [email protected] and ask for them under NDA.
- The policy set
- Statement of Applicability
- Data processing agreement
- CAIQ Lite
A privacy question can still go to the privacy contact. A full policy is a request, not a page on this site.