Information security policy

Owner: Mira Holm · Approved by: Rafael Duarte, Quinn Maas · Reviewed: every year, and after any major change. Last review 30 June 2026.

This is the summary everyone at ACME reads and agrees to when they join. The pages linked below say how.

Scope

ACME's sign-in and access service (identity-service, portal, notifier), the AWS accounts it runs in, the code on GitHub, the tools we use to support customers, and every laptop and account of every person who works for ACME, staff or contractor.

Who does what

• Mira Holm, security and platform lead: owns this policy and the security pages.
• Maja Schulz, compliance and operations: ISO 27001, audits, suppliers, access reviews.
• Rafael Duarte, CTO: accountable for security in engineering.
• Every manager: makes sure their people's access fits their job, and asks for it to be removed when it doesn't.
• Everyone: follows this policy and reports anything that looks wrong.

Rules

1. Least access. People get the access their job needs and lose it when the job changes. Reviewed every quarter (Access reviews).
2. MFA everywhere. Every work account uses MFA (MFA policy).
3. Customers' data stays in their region, and only a named few in support can open it, through a logged and approved request (Data regions, Support access to customer data).
4. Encrypted at rest and in transit (Encryption and keys).
5. No customer data outside our systems. Not in email attachments, chat, personal drives, or AI tools.
6. Secure development. Every change is reviewed by another engineer and passes CI. Dependencies are scanned weekly and on every change (Vulnerability management).
7. Suppliers who handle customers' data are on the Sub-processors list, have a DPA, and are reviewed every year.
8. Laptops are ACME's, encrypted, locked after five minutes, and updated within a week of a release.
9. Incidents are reported at once and handled per Incident response.
10. Training: security training when you join and every year.

AI coding tools

Added 30 June 2026. Engineers may use Codex and Claude Code on ACME's repositories, each through their own personal token in Emargen, so every call is tied to a person and logged. No customer data, production credentials or customers' certificates go into a prompt. The tools work on code and on test data only.

Exceptions

Ask Mira in writing. An exception has an owner, a reason and an end date, and is listed in the ISO 27001 risk register.