Security, Privacy & Data Custody at CABflo.

Information Security Policy

CABflo establishes information-security objectives and controls appropriate to the risks associated with its products, services, people, technology and information assets.

• Security responsibilities are assigned to appropriate personnel.
• Security risks are identified, assessed and treated according to their significance.
• Security requirements are incorporated into operational and technology decisions.
• Policies and controls are reviewed when material changes or new risks arise.
• Security awareness and responsible handling of information are promoted across relevant personnel.

Access Control Policy

Access to CABflo environments, functions and customer information is restricted according to role, authorization and business need.

• Unique user identities should be used for individual access.
• Permissions should follow least-privilege principles.
• Privileged administrative access is restricted and controlled.
• Access rights should be reviewed and removed when no longer required.
• Authentication credentials must be kept confidential and protected from unauthorized use.
• Where supported and appropriate, stronger authentication such as OTP or multi-factor authentication may be required.

Customer Data Protection Policy

CABflo treats Certification Body records and associated information as customer-controlled business information. Data is processed only for agreed service purposes and applicable legal, contractual and operational requirements.

• Customer information is protected against unauthorized access, disclosure, alteration and loss.
• CABflo personnel are not authorized to use customer certification data for unrelated business purposes.
• Customer data access is limited to authorized operational or support purposes where required by the service arrangement.
• Requests for customer information are subject to authorization and applicable legal requirements.

Privacy Policy

CABflo applies privacy-by-design principles to personal information processed through its services. Depending on the customer, user, location and processing activity, applicable privacy requirements may include GDPR/UK GDPR, Saudi Arabia's Personal Data Protection Law (PDPL), Pakistan privacy requirements, or other applicable data-protection laws.

• Personal information should be collected for defined and legitimate purposes.
• Only information reasonably necessary for the service should be collected.
• Personal information should be protected through appropriate technical and organizational measures.
• Retention should be limited to applicable legal, contractual and operational requirements.
• International transfers should be handled using mechanisms required by applicable law.

Cryptography & Secure Transmission Policy

Where technically applicable, CABflo uses industry-accepted cryptographic protections to reduce the risk of unauthorized disclosure during transmission and storage. Exact algorithms, key-management architecture and encryption configuration may depend on the deployed environment and infrastructure provider.

• Encrypted connections should be used for authenticated access and sensitive communications.
• Secrets, keys and credentials should not be exposed in application code or public repositories.
• Cryptographic material should be protected against unauthorized access.
• Cryptographic practices should be reviewed as technology and threat conditions evolve.

Backup & Recovery Policy

Business-critical platform information should be backed up according to defined operational requirements. Backups are treated as protected information and should be subject to access controls and recovery procedures.

• Backup frequency is determined by service and business requirements.
• Backups should be protected against unauthorized access or modification.
• Recovery procedures should be tested periodically where applicable.
• Customer-specific recovery objectives are confirmed in the applicable agreement.

Security Incident Response Policy

CABflo maintains an incident-management approach for identifying, assessing, containing, investigating, resolving and learning from security events.

• Suspected security incidents should be reported through designated internal channels.
• Incidents are assessed according to impact, scope and affected information.
• Containment and remediation actions are prioritized according to risk.
• Relevant evidence and investigation records should be preserved.
• Where a confirmed incident materially affects customer data, CABflo will follow applicable contractual and legal notification requirements.

Availability & Business Continuity Policy

CABflo is designed to support continuity of Certification Body operations through resilient infrastructure, backup practices and recovery planning appropriate to the deployed environment.

• Critical services and dependencies should be identified.
• Recovery procedures should be documented and maintained.
• Continuity risks should be considered when significant system or supplier changes are made.
• Specific uptime, RTO and RPO commitments are contractual where applicable and are not implied by this public policy.

Change Management Policy

Changes to production systems, infrastructure, application functionality and security-sensitive configurations should be planned, reviewed, tested and deployed through controlled processes appropriate to risk.

• Material changes should have an identified owner and purpose.
• Security and operational impact should be considered before deployment.
• Testing should be performed where appropriate to the change risk.
• Emergency changes should be documented and reviewed retrospectively.
• Significant changes should be traceable.

Logging, Monitoring & Audit Trail Policy

CABflo supports traceability of relevant platform activities through system records and audit trails. Logging is designed to support accountability, troubleshooting, security investigation and operational oversight.

• Relevant authentication, administrative and business actions may be logged.
• Logs should be protected against unauthorized alteration.
• Access to security logs should be restricted.
• Retention periods should reflect operational, legal and contractual requirements.
• Monitoring practices may vary by deployment and service configuration.

Third-Party & Supplier Security Policy

Where CABflo uses third-party infrastructure, cloud services, communication services, analytics, support tools or other suppliers, their security relevance is considered as part of supplier management.

• Security and privacy requirements should be considered before material suppliers are engaged.
• Relevant contractual safeguards should be established where appropriate.
• Material supplier changes should be assessed for security and availability impact.
• Subprocessor information and customer notification arrangements are governed by the applicable service agreement where relevant.

Data Retention, Return & Secure Deletion Policy

Customer data retention and deletion are governed by applicable law, the service agreement, customer instructions and operational requirements.

• Data should not be retained indefinitely without a legitimate requirement.
• At service termination, CABflo and the customer should follow the agreed data-return and deletion process.
• Deletion may be subject to legally required retention, backup cycles or security/legal holds.
• Where technically and contractually applicable, deletion processes should be designed to prevent routine recovery of deleted information.

Secure Development & Vulnerability Management Policy

CABflo aims to incorporate security throughout the software-development lifecycle, including requirements, design, development, testing, deployment and maintenance.

• Security requirements should be considered for new features and material changes.
• Code and configuration changes should be reviewed according to risk and development practices.
• Dependencies and known vulnerabilities should be monitored where applicable.
• Security defects should be prioritized according to severity and exposure.
• Development and production access should be appropriately separated.

Personnel Security & Confidentiality

Personnel with access to CABflo information or systems are expected to understand their information-security responsibilities and protect confidential information.

• Access should be based on job responsibilities and business need.
• Confidentiality obligations should apply to relevant personnel and contractors.
• Security awareness should be provided according to role and risk.
• Access should be removed or adjusted when personnel change roles or leave.

Customer Data Custody & Dedicated Environment Policy

Certification Bodies requiring additional data-custody or isolation controls may discuss dedicated or customer-controlled deployment arrangements. Depending on the agreement, architecture may define hosting location, administrative boundaries, access responsibilities, encryption, network controls, backup ownership and data-export procedures.

Important: A dedicated or customer-controlled environment is a specific technical and contractual arrangement and is not automatically included in every CABflo deployment.

Data Subject Rights & Privacy Requests

Where applicable law grants individuals rights regarding their personal data, CABflo will support the customer in responding to valid requests within the scope of the service and applicable contractual responsibilities.

• Requests may include access, correction, deletion, restriction, objection or portability where legally applicable.
• Requests may require identity verification and confirmation of the relevant customer relationship.
• Legal exemptions, retention obligations and other applicable limitations may apply.

Acceptable Use & Customer Security Responsibilities

Customers are responsible for using CABflo lawfully and maintaining appropriate security within their own organization.

• Users must not share credentials or intentionally bypass access controls.
• Customers must not upload information they are not authorized to process.
• Customers should promptly disable accounts that are no longer required.
• Customers should report suspected compromise, unauthorized access or security incidents promptly.
• CABflo must not be used to conduct unlawful activity or attack other systems.

Security Governance, Risk & Continual Improvement

CABflo's security framework is intended to evolve with the threat environment, technology, legal requirements and business risk. Security policies and controls should be reviewed periodically and when significant changes occur.

• Security risks should be assessed and treated according to organizational context.
• Control effectiveness should be evaluated through appropriate monitoring, review and improvement activities.
• Material security findings should be tracked to closure according to risk.
• Policies should be reviewed and updated when necessary.