Data Security Policy

Introduction

Our clients entrust valuable data to us. BLDX is committed to protecting the integrity, confidentiality, and availability of both our data and our clients’ data. This Data Security Policy outlines the principles, practices, and procedures we follow to ensure data security across our operations and services.

1. Purpose

This policy aims to protect our clients’ information assets, ensure compliance with applicable regulations, and establish a framework for secure data handling.

2. Scope

This policy applies to all employees, contractors, vendors, and other parties with access to our information systems, networks, and data.

3. Roles and Responsibilities

  • Chief Technology Officer:
    • Oversees the implementation and maintenance of the data security policy
    • Conducts regular security audits and assessments
    • Ensures compliance with relevant laws and regulations
  • IT Department:
    • Implements and manages technical security measures
    • Monitors and responds to security incidents
  • All Employees:
    • Adhere to the data security policy
    • Report security incidents or suspicious activities

4. Data Classification

Data is classified into the following categories:

  • Public: Information intended for public use
  • Internal: Information restricted to internal use within the company
  • Confidential: Sensitive information requiring strict access controls
  • Highly Confidential: Critical information with the highest level of security controls

5. Third-Party Storage and Applications

All subprocessors and software services used by BLDX meet or exceed our security standards.

A list of these software services is available upon request.

6. Access Control

  • User Access Management:
    • Access to data is granted based on the principle of least privilege
    • Regular review and recertification of access rights
    • Immediate revocation of access upon employee termination
    • Use of password and key management software
  • Authentication and Authorization:
    • Multi-factor authentication (MFA) is required for access to sensitive systems and applications
    • Password Security: Internal password management policy includes complexity and length requirements

7. Data Encryption

  • Data at Rest:
    • Encryption of sensitive data stored on company systems and databases
    • Use of industry-standard encryption algorithms
    • Customer data is encrypted on BLDX hardware, in Cloud storage, Postgres database tables, and backups
    • Employee hardware has disk encryption enabled
  • Data in Transit:
    • Encryption of data transmitted over networks using TLS/SSL
    • VPN requirement for remote access to BLDX systems

8. User Data Control

  • Data Control and Erasure:
    • BLDX customers are controllers of their data, responsible for information they create, use, store, process, and destroy. Customers can request data deletion or self-serve their deletion when not subject to regulatory or legal retention requirements
    • We support user data control through decentralized architecture where possible. In these cases, users’ keys control access, data updates, and deletions, with BLDX acting only with permission
  • Data Privacy:
    • Please refer to our Privacy Policy for more information

9. Data Backup and Recovery

  • Backup Procedures:
    • Regular backups of critical data
    • Secure storage of backup data
    • Point-in-time recovery
  • Disaster Recovery Plan (DRP):
    • Documentation and testing of disaster recovery procedures
    • Business continuity planning and regular drills
    • Backup and recovery documentation

10. Network Security

  • Firewalls and Intrusion Detection/Prevention Systems (IDS/IPS):
    • Implementation of firewalls to segregate network segments
    • Regular monitoring and updating of IDS/IPS
  • Network Access Control (NAC):
    • Control and monitoring of devices connecting to the company network
    • Monthly network vulnerability assessments

11. Endpoint Security

  • Antivirus and Anti-Malware:
    • Deployment of antivirus and anti-malware solutions on all endpoints
    • Regular updates and scans
    • Macs are standard hardware
  • Endpoint Detection and Response (EDR):
    • Continuous monitoring and response to threats on endpoints
    • We use Cloudflare Detection and Response

12. Application Security

  • Secure Development Practices:
    • Adoption of Secure Software Development Lifecycle (SDLC) practices
    • Regular code reviews and security testing (static and dynamic analysis)
  • Vulnerability Management:
    • Regular vulnerability scanning and patch management (Github monitors packages for vulnerabilities)
    • Timely remediation of identified vulnerabilities
  • Web Application Firewall (WAF):
    • BLDX uses Cloudflare for all web applications

13. Incident Response

  • Incident Response Team (IRT):
    • Dedicated team for handling security incidents
    • Clear incident reporting and escalation procedures
  • Incident Management:
    • Documentation and analysis of security incidents
    • Review and implementation of corrective actions to prevent recurrence

14. Physical Security

  • Access Controls:
    • Restricted physical access to sensitive areas (e.g., data centers)
    • Use of key cards, biometric scanners, and surveillance systems
  • Environmental Controls:
    • Protection measures against physical threats (e.g., fire, flood)

15. Third-Party Security

  • Vendor Management:
    • Security assessment and due diligence of third-party vendors
    • Data security requirements in contracts
  • Data Sharing:
    • Secure transfer of data to third parties
    • Monitoring and auditing of third-party data handling practices

16. Employee Training and Awareness

  • Security Awareness Programs:
    • Regular training on data security policies and practices
    • Phishing simulations and security awareness activities
  • Policy Acknowledgment:
    • Annual acknowledgment and agreement to adhere to the data security policy

17. Compliance and Legal Requirements

  • Regulatory Compliance:
    • Adherence to relevant data protection laws and regulations (GDPR, CCPA, HIPAA)
    • Regular audits and compliance assessments
  • Policy Review:
    • Annual review and update of the data security policy
    • Documentation and approval of policy changes

18. Monitoring and Reporting

  • Security Monitoring:
    • Continuous monitoring of systems and networks for security threats
    • Use of Security Information and Event Management (SIEM) systems
  • Reporting Mechanisms:
    • Clear channels for reporting security incidents and policy violations
    • Anonymous reporting options for employees

19. Policy Enforcement

  • Disciplinary Actions:
    • Consequences for non-compliance with the data security policy
    • Procedures for handling policy violations

20. Appendix

  • Insurance Policies and Certificates as evidence.
  • Definitions:
  1. Data Classification: The categorization of data based on its sensitivity and importance to the organization. Common classifications include:
  • Public: Information that can be freely shared
  • Internal: Information for use within the organization
  • Confidential: Sensitive information with restricted access
  • Restricted: Highly sensitive information with strictly limited access
  1. Access Control: Procedures and systems for granting, modifying, and revoking access rights to data and systems, including authentication and authorization mechanisms
  2. Data Owner: The individual or entity responsible for the accuracy, integrity, and timeliness of a specific set of data
  3. Data Custodian: The person or group responsible for implementing and maintaining security controls for data as specified by the data owner
  4. Personally Identifiable Information (PII): Any data that can be used to identify a specific individual
  5. Encryption: The process of encoding data to protect its confidentiality during storage or transmission
  6. Data Breach: An incident where unauthorized access to data occurs, potentially compromising its confidentiality, integrity, or availability
  7. Incident Response: The process of detecting, reporting, and responding to security incidents or data breaches
  8. Data Retention: Guidelines for how long different types of data should be kept and procedures for secure disposal or deletion
  9. Vulnerability: A weakness in an information system, security procedure, or implementation that could be exploited by a threat
  10. Threat: Any circumstance or event with the potential to adversely impact organizational operations, assets, or individuals through unauthorized access, destruction, disclosure, or modification of information
  11. Risk Assessment: The process of identifying, analyzing, and evaluating potential security risks to data and systems
  12. Audit Trail: A chronological record of system activities that provides evidence of data access, modification, or deletion
  13. Least Privilege: A security principle requiring that users be given the minimum level of access necessary to perform their job functions
  14. Data Integrity: Ensuring that data remains accurate, complete, and unaltered throughout its lifecycle