Information Security Policy

1. Purpose

This Information Security Policy sets out the principles, controls, and responsibilities that Atine Labs™ Limited applies to protect the confidentiality, integrity, and availability of information assets — including client data hosted on our platforms and internal company data.

2. Scope

This policy applies to all Atine Labs™ Limited employees, contractors, partners, and third parties who access or process company or client information systems.

3. Security Principles

• Security by design: security controls are built into all products and infrastructure from the outset
• Least privilege: access is granted on a need-to-know basis
• Defence in depth: multiple layered security controls
• Continuous monitoring: real-time detection of threats and anomalies

4. Access Controls

All systems require authentication. Privileged access requires multi-factor authentication (MFA). Access rights are reviewed quarterly. Credentials are never shared and must meet minimum complexity requirements.

5. Data Encryption

Data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256 or equivalent. Encryption keys are managed through a dedicated key management system with rotation policies.

6. Vulnerability Management

Regular vulnerability scans are conducted across all production systems. Critical vulnerabilities are remediated within 72 hours; high within 7 days. See our Vulnerability Reporting Policy for responsible disclosure.

7. Incident Response

Security incidents are managed in accordance with our Incident Management Policy. Personal data breaches are reported to relevant supervisory authorities within 72 hours where required by law.

8. Physical Security

Where applicable, physical access to systems and data centres is controlled, logged, and restricted to authorised personnel.

9. Supplier Security

All sub-processors and key suppliers are assessed for security compliance before engagement and are subject to contractual security requirements.

10. Business Continuity

Security arrangements are integrated with our Disaster Recovery & Business Continuity Plan.

11. Training & Awareness

All staff receive annual security awareness training. Role-specific training is provided for system administrators and developers.