GenieAI Sicherheit
Schutz auf Unternehmensniveau für Ihre Rechtsdaten

Die Genie-Plattform wird auf Amazon Web Services gehostet. Der Zugriff auf die Produktionsumgebung ist auf autorisiertes Personal beschränkt, wird überwacht und ist durch Mehrfaktor-Authentifizierung geschützt, ausschließlich über verschlüsselte Verbindungen.

• Encryption key access restricted Privileged access to encryption keys is restricted to authorised users with a business need.
• Unique account authentication Authentication to systems and applications uses unique credentials or authorised SSH keys.
• Production application access restricted System access is restricted to authorised personnel only.
• Production database access restricted Privileged database access is restricted to authorised users with a business need.
• Firewall access restricted Privileged firewall access is restricted to authorised users with a business need.
• Production OS access restricted Privileged operating system access is restricted to authorised users with a business need.
• Production network access restricted Privileged production network access is restricted to authorised users with a business need.
• Unique network system authentication Production network authentication uses unique credentials or authorised SSH keys.
• Remote access MFA enforced Production systems are remotely accessible only by authorised employees with a valid multi-factor authentication method.
• Remote access encrypted Production systems are remotely accessible only via approved encrypted connections.
• Infrastructure performance monitored Monitoring tools watch systems and infrastructure and generate alerts when predefined thresholds are met.
• Network firewalls utilised Firewalls are configured to prevent unauthorised access.
• Network and system hardening Hardening standards are documented, follow industry best practice, and are reviewed at least annually.

Die personellen und prozessualen Kontrollen neben der technischen Ebene: unterzeichneter Verhaltenskodex, durchgesetzte Passwortrichtlinie, zentral verwaltete Geräte, jährliche Sicherheitsschulungen und vierteljährliche Zugriffsprüfungen.

• Production inventory maintained A formal inventory of production system assets is kept up to date.
• Code of Conduct acknowledged Employees acknowledge a Code of Conduct at hire. Violations are subject to a documented disciplinary policy.
• Password policy enforced Passwords for in-scope system components are configured according to a documented Password Policy.
• MDM system in use A mobile device management system centrally manages company-issued devices supporting the service.
• Security awareness training All staff complete information security and acceptable use training at onboarding, refreshed at least annually.
• Joiner, mover, leaver process Access is granted by role and removed promptly when personnel leave or change roles. Quarterly access reviews are recorded in the Access Rights Review Log.

Verschlüsselung, Monitoring und sichere Entwicklung sind in die Plattform eingebaut. Kundendaten werden im Ruhezustand mit AES-256 und bei der Übertragung mit TLS 1.2 oder höher verschlüsselt, und jede Codeänderung wird vor der Freigabe von Kollegen geprüft.

• Data encryption at rest Datastores housing sensitive customer data are encrypted at rest using AES-256 or equivalent.
• Data transmission encrypted Confidential and sensitive data is transmitted over public networks using TLS 1.2 or higher.
• Control self-assessments Self-assessments are performed at least annually to verify controls remain effective. Findings are tracked to closure within an SLA.
• Vulnerability and system monitoring Vulnerability management and system monitoring are documented, with internal scanning supplemented by independent penetration testing following significant changes.
• Secure software development All code changes are peer reviewed and tested. Deployment is separated from development so only authorised release managers ship to production.
• Environment segregation Development, test, staging, and production environments are logically separated.

Dokumentierte Verfahren für die entscheidenden Momente. Für Incident Response, Geschäftskontinuität, Backups und Risikomanagement ist jeweils eine benannte Rolle innerhalb des ISMS zuständig.

• Continuity and disaster recovery A documented Business Continuity and Disaster Recovery Plan defines recovery priorities, communication paths, and a recovery time objective of one hour for critical services.
• Management roles defined Named roles inside the ISMS oversee the design and implementation of information security controls.
• Incident response policy Security and privacy incident response policies are documented and communicated to authorised users.
• Incident management Incidents are logged, tracked, resolved, and communicated to affected parties through the Incident and Corrective Action Log.
• Backup and restoration Critical systems and data are backed up to encrypted, redundant storage and are tested for recovery.
• Risk management programme A documented risk management programme covers threat identification, risk rating, and mitigation. Risks are reviewed during ISMS management reviews.

GenieAI handelt als Auftragsverarbeiter. Für alle personenbezogenen oder vertraulichen Daten, die Sie hochladen, bleiben Sie Verantwortlicher. Wir erfüllen die UK-DSGVO und den Data Protection Act 2018.

• Data retention and disposal Formal procedures govern the retention and secure disposal of company and customer data.
• Data classification policy A data classification policy ensures confidential data is properly secured and restricted to authorised personnel.
• Data subject rights Processes are in place to handle access, rectification, erasure, and objection requests within statutory timeframes.
• Data export and deletion on exit On contract termination customer data can be returned or securely deleted in line with the customer agreement.