Cafiyn Innovations LLP is committed to protecting the confidentiality, integrity, availability, and privacy of information entrusted to us by customers, partners, employees, and users.
This Information Security Policy outlines the administrative, technical, and organizational controls implemented by Cafiyn to manage information security risks.
This Policy applies to:
Cafiyn maintains a risk-based security program designed to:
Security controls are reviewed periodically and updated based on business requirements and emerging threats.
Access to systems and information is granted based on business need and least privilege principles.
Controls include:
Users are prohibited from sharing credentials.
Authentication controls include:
Passwords are never stored in plaintext.
Information may be classified as:
Access controls are applied according to classification.
Cafiyn implements safeguards designed to protect information against unauthorized access, disclosure, alteration, or destruction.
Measures include:
Security practices may include:
Security issues identified during development are prioritized based on risk.
Cafiyn utilizes reputable cloud service providers that maintain industry-standard security controls.
Cloud environments may include:
Security-relevant activities may be logged and monitored including:
Logs are retained according to operational and legal requirements.
Cafiyn maintains processes for:
Critical vulnerabilities are prioritized for remediation.
Cafiyn maintains procedures to:
Security incidents are handled according to internal response procedures.
Where legally required and where customer information is affected, Cafiyn will provide notification without undue delay following confirmation of a reportable incident.
Notifications may include:
Appropriate backup measures are implemented to support business continuity and disaster recovery objectives.
Backup procedures may include:
Cafiyn maintains reasonable measures to support continuity of operations during disruptive events.
Such measures may include:
Personnel with system access may be subject to:
Access is revoked upon termination of employment or engagement.
Third-party providers may be evaluated based on:
Only authorized providers are permitted access to business-critical systems.
Security researchers who discover vulnerabilities are encouraged to report them responsibly to infosec@cafiyn.com.
Reports should include:
Full disclosure guidelines, scope, and safe harbor terms are described in our Acceptable Use and Responsible Disclosure Policy.
Without prior written authorization, individuals may not:
Unauthorized activities may result in legal action.
Customers and prospects may request information about our security practices, including completed security questionnaires, by contacting infosec@cafiyn.com. Responses are provided subject to reasonable confidentiality obligations.
This Policy may be reviewed and updated periodically to reflect changes in technology, threats, legal requirements, or business operations.
Security contact: infosec@cafiyn.com
For security inquiries, vulnerability reports, compliance requests, or security questionnaires, contact the above address.
Questions about this policy? Email infosec@cafiyn.com.
← All policies