Security at Confida

Track and approve changes to the ISMS, systems and software, including operational software installation, with appropriate impact assessment, testing and implementation records.

Use independent network and application penetration testing at least annually to identify exploitable weaknesses and feed documented findings into the vulnerability-remediation process.

Processing activities are defined and errors in processing are detected and corrected in a timely manner.

If access is denied, data subjects are informed of the reason a request for access to their personal information was denied, and the individual's right, if any, to challenge such denial, as specifically permitted or required by law or regulation.

The Company creates and maintains a record of authorized disclosures of personal information that is complete, accurate, and timely.

Personal information is used only for the intended purposes for which it was collected and only when implicit or explicit consent has been obtained.

Deploy, centrally manage and monitor appropriate malware defenses, keep protection current and support it with user awareness and restrictions on unauthorized software.

Use a tracked offboarding process to disable access, retire identities, recover organizational assets and communicate continuing security responsibilities when employment or agreements end or change.

The company's security commitments are communicated to customers in Master Service Agreements (MSA) or Terms of Service (TOS).

The Company Managers complete performance reviews for employees at least annually.

The Company's Board of Directors (or equivalent) are separate and independent from the company's management.

Provide and maintain sufficient infrastructure redundancy and traffic distribution to meet availability requirements, including failure handling for critical dependencies.

Management has established a Backup and Recovery Policy to define procedures for the performance of backup and recovery operations, in accordance with management objectives for system availability.

Run and protect backups of required information, software and systems under the agreed backup policy, using schedules, retention and separate storage that support recovery needs.

Monitor protected premises for unauthorized access and suspicious activity and respond to detected physical security events, protecting the monitoring information.

Operate visitor authorization and sign-in procedures for protected facilities and data-center access, with appropriate supervision and retained visit records.