Security Policy

Data Protection and Privacy

We are committed to protecting the personal and business information of our users. All customer data is handled in compliance with applicable data protection regulations, including [e.g., GDPR, if applicable].

Access Control

Access to systems and data is restricted based on the principle of least privilege.
Role-based access controls (RBAC) are implemented across all internal tools and
platforms.
Multi-factor authentication (MFA) is required for all administrative access.

Data Encryption

Data is encrypted in transit using TLS (Transport Layer Security).
Data at rest is encrypted using industry-standard encryption protocols (e.g., AES-256).
Sensitive fields in databases (e.g., financial records, user credentials) are encrypted or hashed.

Network and Infrastructure Security

Our infrastructure is hosted on secure cloud environments with firewalls, intrusion
detection, and regular monitoring.
We implement network segmentation and rate limiting to prevent unauthorized access
and denial-of-service (DoS) attacks.
Patches and updates are applied regularly to all servers and software components.

Security Monitoring and Incident Response

All systems are continuously monitored for suspicious activity and performance anomalies.
In the event of a data breach or security incident, we have a documented Incident
Response Plan to contain, assess, and resolve the issue swiftly.
Affected stakeholders will be notified in accordance with applicable laws and our internal policies.

Vulnerability Management

Regular security audits, penetration testing, and code reviews are conducted.
Third-party dependencies and libraries are continuously scanned for known vulnerabilities using automated tools.

Employee Training and Access and Access

All employees undergo security awareness training as part of their onboarding process.
Ongoing training is provided to ensure staff stay updated on current security best practices and risks.

Vendor and Third-Party Risk Management

We assess all third-party vendors and partners for their security practices.
Data shared with external service providers is governed by strict contractual agreements.

Backup and Disaster Recovery

Regular backups are taken and stored securely in geographically diverse locations.
We maintain a Business Continuity and Disaster Recovery Plan to ensure minimal service disruption.

User Credentials and Authentication

Credit Objects does not store any user passwords or sensitive authentication data on its servers.
All user identity management, authentication, and authorization processes are securely
handled via Amazon Cognito, a managed identity service by AWS.
Cognito ensures that user credentials are securely encrypted, and access tokens are
managed according to best-in-class security standards.
This approach minimizes the risk of unauthorized access and ensures compliance with
modern identity and access management (IAM) practices.

info@creditobjects.com.au