Security
By Mira Holm · created 9 Jan 2023, 09:00 UTC · last updated 27 Oct 2026, 15:00 UTC · version 11
space-homesecurity
Security policies and records for ACME. Owner: Mira Holm (security and platform lead). Compliance: Maja Schulz. Accountable: Rafael Duarte (CTO).
Report anything that looks wrong to security@acme-hq.example or to Mira directly. If customers' people can't sign in, or data may have been seen by someone it shouldn't, it is an incident: follow Incident response.
Policies
- Information security policy
- MFA policy
- Encryption and keys
- Support access to customer data
- Vulnerability management
- Incident response
Customers' data
- Data regions: where each customer's data is kept.
- Sub-processors: who else touches it.
Records
- Access reviews, every quarter.
- ISO 27001 notes: certificate, audits, findings.
- Penetration test 2026.
For sales and customer success
Security questionnaires: standard answers. Tom Weber keeps it; Mira signs off anything new.
Now
| What | Owner | Status |
|---|---|---|
| Penetration test findings: three medium | Marek, Aiko | Fixes due 20 November |
| Q4 access review | Maja | Starts 30 November |
| UK customers' mail through the EU account? | Mira | Decision by 30 November |
| Halden Foods onboarded in the EU | Clara, Mira | Organisation created 27 October |