Controls

Data Backup and Recovery

Critical data including customer data, source code, and business records is backed up regularly. Backups are tested periodically to ensure successful recovery.

Data Classification

Data is classified into sensitivity levels (e.g., public, internal, confidential, restricted) with defined handling requirements for each level.

Data Encryption

Sensitive and confidential data is encrypted at rest using AES-256 or equivalent, and in transit using TLS 1.2+ or VPN. Encryption standards are applied consistently across all systems.

Data Retention and Deletion

Data retention periods are defined based on regulatory and business requirements. Data is securely deleted when no longer needed, using approved sanitization methods.

Key and Secret Management

Cryptographic keys, API tokens, and secrets are stored in dedicated secret management systems. Secrets are never hardcoded in source code or configuration files.