DIGITTPAY SOLUTIONS LLP

This Policy establishes the information-security governance framework for protecting DIGITTPAY SOLUTIONS LLP's information, systems, applications, customer and transaction data, gift card/voucher services and technology infrastructure.

• Protect confidentiality, integrity and availability of information.
• Prevent unauthorised access, disclosure, alteration, destruction or misuse.
• Maintain secure and resilient technology supporting business operations.
• Manage information-security risks proportionately to business impact.
• Support compliance with applicable legal, contractual and security requirements.

This Policy applies to employees, contractors, vendors and all information assets, applications, APIs, websites, databases, endpoints, networks, cloud services, source code, credentials, logs and business records used by or for the Company.

• Need-to-know and least privilege
• Defence in depth
• Secure-by-design and secure-by-default where practical
• Risk-based controls
• Continuous monitoring and improvement
• Accountability and traceability

Material information assets should be identified, assigned an owner and managed throughout their lifecycle, including acquisition, use, maintenance, transfer and disposal.

• Access shall be based on business need.
• Least privilege shall be applied.
• Shared accounts should be avoided where practical.
• Privileged access shall be restricted and monitored.
• Access should be reviewed periodically.
• Access shall be revoked promptly when no longer required.

Systems handling sensitive or critical information should use appropriate authentication controls. Strong passwords, multi-factor authentication and secure credential-management practices shall be used where proportionate to risk and technically available.

• Credentials shall remain confidential.
• Credentials shall not be shared or stored insecurely.
• Privileged credentials shall receive enhanced protection.
• Compromised credentials shall be reset or revoked promptly.
• Secrets and API keys shall be protected from unauthorised disclosure.

The Company shall apply appropriate controls for network segmentation, secure configuration, firewalls, endpoint protection, remote access, vulnerability management and infrastructure monitoring based on risk.

• Secure development practices
• Input validation and appropriate authentication
• Authorisation checks
• Protection of API credentials and secrets
• Logging of material security events
• Vulnerability testing where appropriate
• Controlled deployment and change management

Customer, transaction, voucher, financial, security and confidential information shall be protected against unauthorised access, disclosure, modification, loss or destruction using appropriate technical and organisational controls.

Encryption should be used where appropriate to protect sensitive information in transit and, where proportionate and technically feasible, at rest. Encryption keys and secrets shall be protected from unauthorised access.

Critical systems should maintain appropriate logs for security, operational and investigation purposes. Monitoring may include authentication events, privileged access, transaction anomalies, system alerts and other relevant indicators.

• Identify vulnerabilities through appropriate scanning, testing or vendor information.
• Prioritise remediation based on severity and business impact.
• Apply security patches within risk-appropriate timelines.
• Track material vulnerabilities until remediation or approved risk acceptance.

Endpoints and servers shall use appropriate security controls such as malware protection, secure configuration, software restrictions and timely updates based on risk.

Material changes to production systems, security configurations, APIs or critical infrastructure shall follow an approved change-management process with appropriate testing, authorisation and rollback planning.

Critical data and systems shall be backed up according to continuity requirements. Backups shall be protected against unauthorised access, alteration and destructive events and restoration should be tested where practical.

Remote access and mobile use shall be subject to appropriate authentication, device security, secure connectivity, access restrictions and confidentiality requirements.

Third parties with access to Company systems or sensitive information shall be subject to proportionate security due diligence and contractual requirements under the Third-Party / Vendor Risk Management Policy.

Information-security incidents shall be reported and handled under the Incident Response & Cyber Security Incident Management Policy, including containment, investigation, evidence preservation and recovery.

Where Company systems, records or equipment are located in physical premises, reasonable controls shall be applied to prevent unauthorised access, theft, damage or loss.

• Security awareness and role-based training
• Confidentiality obligations
• Appropriate use of Company systems
• Prompt reporting of suspected incidents
• Secure handling of credentials and information
• Access removal on role change or exit

Confidential or sensitive information shall be transferred only through authorised channels and protected using appropriate security measures.

Personnel shall receive periodic security awareness appropriate to their roles, including phishing, social engineering, password security, data protection and incident reporting.

Information-security controls shall support the Business Continuity & Disaster Recovery Policy, including backup, recovery, resilience and secure restoration.

Material information-security risks should be identified, assessed, assigned owners and treated through preventive, detective or corrective controls. Material residual risks shall be escalated appropriately.

The Company may conduct vulnerability assessments, penetration testing, access reviews, configuration reviews, audits, security exercises or other assurance activities based on risk and available resources.

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory security, legal, regulatory and contractual requirements shall not be bypassed.

Security policies, risk assessments, access reviews, security incidents, testing results, approvals and material corrective actions shall be retained according to applicable requirements.

This Policy shall be reviewed at least annually and following material security incidents, major technology changes, significant audit findings or changes in applicable requirements.