Security Policy
This Security Policy ("Policy") outlines the security measures and practices implemented by FlosslyOS Ltd. ("Flossly," "we," "us," or "our") to protect the confidentiality, integrity, and availability of our AI Powered Task Manager & CRM software ("Platform") and the data processed through it.
We are committed to maintaining the highest standards of security to protect our users' information and ensure the safe operation of our Platform. This Policy describes our comprehensive security framework and ongoing security practices.
By using our Platform, you acknowledge that you have read and understood this Security Policy. We reserve the right to update this Policy as needed to reflect changes in our security practices or applicable regulations.
1. Security Framework
Our security framework is built on industry best practices and compliance standards, including:
- ISO 27001 Information Security Management System
- GDPR and UK Data Protection Act 2018 compliance
- NIST Cybersecurity Framework alignment
- Healthcare industry security standards (for medical data)
- Regular third-party security assessments
2. Data Encryption
We implement multiple layers of encryption to protect your data:
- Data in Transit: TLS 1.3 encryption for all data transmission
- Data at Rest: AES-256 encryption for stored data
- Database Encryption: Transparent Data Encryption (TDE) for databases
- File Storage: Encrypted file storage with secure key management
- Backup Encryption: All backups are encrypted before storage
3. Access Controls and Authentication
We maintain strict access controls to ensure only authorised personnel can access your data:
- Multi-factor authentication (MFA) for all user accounts
- Role-based access control (RBAC) with principle of least privilege
- Regular access reviews and privilege audits
- Strong password policies and regular password updates
- Session management with automatic timeout
- IP whitelisting for administrative access
4. Infrastructure Security
Our infrastructure is designed with security as a primary consideration:
- Secure cloud hosting with enterprise-grade security
- Network segmentation and firewall protection
- Intrusion detection and prevention systems (IDS/IPS)
- Regular security patching and updates
- DDoS protection and traffic filtering
- Secure configuration management
5. Application Security
Our Platform is developed and maintained with security best practices:
- Secure coding practices and regular code reviews
- Automated security testing in CI/CD pipeline
- Regular penetration testing and vulnerability assessments
- Input validation and output encoding
- SQL injection and XSS prevention measures
- API security with rate limiting and authentication
6. Data Protection and Privacy
We implement comprehensive data protection measures:
- Data minimisation and purpose limitation
- Pseudonymization and anonymization where appropriate
- Data retention policies and secure deletion
- Cross-border data transfer safeguards
- Regular data protection impact assessments
- Privacy by design and default principles
7. Incident Response
We maintain a comprehensive incident response plan:
- 24/7 security monitoring and alerting
- Dedicated incident response team
- Automated threat detection and response
- Regular incident response drills and training
- Communication protocols for security incidents
- Post-incident analysis and improvement processes
8. Employee Security
Our team is trained and committed to maintaining security:
- Background checks for all employees
- Regular security awareness training
- Confidentiality agreements and security policies
- Secure development training for technical staff
- Incident reporting procedures
- Regular security policy updates and communication
9. Third-Party Security
We ensure our partners and vendors maintain high security standards:
- Vendor security assessments and due diligence
- Data processing agreements with security requirements
- Regular vendor security reviews
- Incident notification requirements
- Compliance verification and audits
- Secure integration and API management
10. Compliance and Auditing
We maintain compliance with relevant security standards:
- Regular internal security audits
- Third-party security assessments
- Compliance monitoring and reporting
- Security metrics and KPIs tracking
- Continuous improvement processes
- Regulatory compliance verification
11. Business Continuity
We maintain business continuity and disaster recovery capabilities:
- Regular data backups with tested restoration procedures
- Disaster recovery planning and testing
- Redundant systems and fail-over capabilities
- Business continuity planning
- Service availability monitoring
- Recovery time and point objectives (RTO/RPO)
12. Security Monitoring and Logging
We maintain comprehensive security monitoring:
- Centralised logging and monitoring systems
- Real-time security event analysis
- Anomaly detection and behavioural analysis
- Security information and event management (SIEM)
- Regular log review and analysis
- Threat intelligence integration
13. Updates and Maintenance
We regularly update our security measures to address emerging threats and maintain the highest security standards. This includes:
- Regular security patch management
- Security tool and technology updates
- Policy and procedure reviews
- Staff training updates
- Threat landscape monitoring
- Security architecture improvements
14. Reporting Security Issues
If you discover a security vulnerability or have concerns about our security practices, please report them to us immediately:
Email: security@flossly.co.uk
Phone: [Security Hotline Number]
Address: FlosslyOS Ltd, [Company Address]
We take all security reports seriously and will investigate and respond promptly. We appreciate your help in keeping our Platform secure.
15. Contact Us
If you have any questions about this Security Policy or our security practices, please contact us at:
Email: security@flossly.co.uk
Address: FlosslyOS Ltd, [Company Address]
Phone: [Contact Number]