Brandkit Information Security Policy

Last Updated: 1 Feb 2025

1. Purpose

Brandkit is committed to protecting customer data and ensuring the security, availability, and confidentiality of its services. This policy outlines security controls and procedures required for SOC 2 compliance.

2. Scope

This policy applies to all employees, contractors, and third-party service providers handling Brandkit systems, data, or infrastructure.

3. Security Policies

3.1 Access Control Policy

Objective

Ensure only authorized personnel have access to systems and data.

Key Controls

• Least Privilege: Access is granted based on job role and business need.
• Multi-Factor Authentication (MFA): Required for all admin accounts and cloud services.
• Access Reviews: Conducted quarterly to validate permissions.
• Offboarding: Immediate removal of access upon contract termination.

3.2 Data Security & Encryption Policy

Response.

Objective

Protect data at rest and in transit.

Key Controls

• Encryption:
  • Data in transit: Enforced via TLS 1.2+.
  • Data at rest: Encrypted using AES-256.
• Data Classification:
  • Confidential (customer data, internal records)
  • Restricted (internal use only)
  • Public (marketing materials)
• Data Retention: Customer data is retained as per contract terms, then securely deleted.

3.3 Security Incident Response Policy

Objective

Quickly detect, respond to, and recover from security incidents.

Incident Classification & Response Times

1. Critical (P1) | Data breach, ransomware, unauthorized admin access | Response: 15 min | Resolution : 4 hours
2. High (P2) | Compromised credentials, malware infection | Response 1 hour | Resolution 24 hours
3. Medium (P3) | Phishing attempt, policy violation | Response 4 hours | Resolution 72 hours
4. Low (P4) | Minor security issue, lost device (no sensitive data) |Response 24 hours | Resolution 7 days

Incident Response Steps

1. Report It: Post in Security Incidents in Basecamp or email security@brandkit.com.
2. Assess & Contain: Security Lead classifies and isolates affected systems.
3. Investigate & Fix: Identify root cause and implement a fix.
4. Document & Learn: Incident report created and lessons incorporated.

3.4 Vendor Management Policy

Objective

Ensure third-party vendors meet security standards.

Key Controls

• Security Review: All new vendors must complete a security questionnaire.
• Contracts: Must include SOC 2-compliant security clauses.
• Annual Reassessment: High-risk vendors reviewed annually.

3.5 Change Management Policy

Objective

Ensure secure and controlled system changes.

Key Controls

• Change Review: All code/config changes reviewed via pull requests in Github
• Testing: Security testing required for major changes.
• Approval Process: High-impact changes require manager approval.

3.6 Disaster Recovery & Business Continuity Policy

Objective

Ensure Brandkit remains operational during a disruption.

Key Controls

• Replication
  • database is replicated in real-time in geo-redundant locations.
  • uploaded files are replicated in real-time in geo-redundant locations.
• Backups:
  • Customer data in database is backed up hourly and daily.
    • Encrypted backups stored in geo-redundant locations.
• Recovery Objectives:
  • RTO (Recovery Time Objective): 4 hours
  • RPO (Recovery Point Objective): 24 hours
• Testing: Disaster recovery plan tested annually.

3.7 Logging & Monitoring Policy

Objective

Detect security threats and unauthorized activity.

Key Controls

• Log Retention: Security logs retained for 12 months.
• Monitoring Tools: Alerts for unauthorized access or suspicious activity.
• Review: Security logs reviewed monthly.

3.8 Security Awareness & Training Policy

Objective

Ensure employees understand security best practices.

Key Controls

• Onboarding Training: All new hires complete security training.
• Ongoing Training: Conducted annually.
• Phishing Tests: Conducted quarterly.

4. Compliance & Enforcement

• Regular SOC 2 audits ensure compliance.
• Failure to follow security policies may result in disciplinary action.

5. Roles & Responsibilities

Role Responsibilities

• All Employees: Report security incidents, follow security policies.
• Security Officer: Manages incidents, oversee security strategy.
• Engineering Team: Implement and maintain security controls.
• Leadership: Ensure compliance and risk management.

6. Policy Review & Updates

This policy is reviewed and updated annually or after major security events.

~ End ~