Seguridad de GenieAI
protección de nivel empresarial para tus datos jurídicos

La plataforma Genie se aloja en Amazon Web Services. El acceso a producción está restringido al personal autorizado, monitorizado y protegido con autenticación multifactor, únicamente a través de conexiones cifradas.

• Encryption key access restricted Privileged access to encryption keys is restricted to authorised users with a business need.
• Unique account authentication Authentication to systems and applications uses unique credentials or authorised SSH keys.
• Production application access restricted System access is restricted to authorised personnel only.
• Production database access restricted Privileged database access is restricted to authorised users with a business need.
• Firewall access restricted Privileged firewall access is restricted to authorised users with a business need.
• Production OS access restricted Privileged operating system access is restricted to authorised users with a business need.
• Production network access restricted Privileged production network access is restricted to authorised users with a business need.
• Unique network system authentication Production network authentication uses unique credentials or authorised SSH keys.
• Remote access MFA enforced Production systems are remotely accessible only by authorised employees with a valid multi-factor authentication method.
• Remote access encrypted Production systems are remotely accessible only via approved encrypted connections.
• Infrastructure performance monitored Monitoring tools watch systems and infrastructure and generate alerts when predefined thresholds are met.
• Network firewalls utilised Firewalls are configured to prevent unauthorised access.
• Network and system hardening Hardening standards are documented, follow industry best practice, and are reviewed at least annually.

Los controles de personas y procesos que acompañan a la capa técnica: código de conducta firmado, política de contraseñas aplicada, dispositivos gestionados de forma centralizada, formación anual en seguridad y revisiones de acceso trimestrales.

• Production inventory maintained A formal inventory of production system assets is kept up to date.
• Code of Conduct acknowledged Employees acknowledge a Code of Conduct at hire. Violations are subject to a documented disciplinary policy.
• Password policy enforced Passwords for in-scope system components are configured according to a documented Password Policy.
• MDM system in use A mobile device management system centrally manages company-issued devices supporting the service.
• Security awareness training All staff complete information security and acceptable use training at onboarding, refreshed at least annually.
• Joiner, mover, leaver process Access is granted by role and removed promptly when personnel leave or change roles. Quarterly access reviews are recorded in the Access Rights Review Log.

Cifrado, monitorización y desarrollo seguro integrados en la plataforma. Los datos de los clientes se cifran en reposo con AES-256 y en tránsito con TLS 1.2 o superior, y cada cambio de código se revisa por pares antes de su publicación.

• Data encryption at rest Datastores housing sensitive customer data are encrypted at rest using AES-256 or equivalent.
• Data transmission encrypted Confidential and sensitive data is transmitted over public networks using TLS 1.2 or higher.
• Control self-assessments Self-assessments are performed at least annually to verify controls remain effective. Findings are tracked to closure within an SLA.
• Vulnerability and system monitoring Vulnerability management and system monitoring are documented, with internal scanning supplemented by independent penetration testing following significant changes.
• Secure software development All code changes are peer reviewed and tested. Deployment is separated from development so only authorised release managers ship to production.
• Environment segregation Development, test, staging, and production environments are logically separated.

Procedimientos documentados para los momentos que más importan. La respuesta a incidentes, la continuidad del negocio, las copias de seguridad y la gestión de riesgos corresponden a roles designados dentro del SGSI.

• Continuity and disaster recovery A documented Business Continuity and Disaster Recovery Plan defines recovery priorities, communication paths, and a recovery time objective of one hour for critical services.
• Management roles defined Named roles inside the ISMS oversee the design and implementation of information security controls.
• Incident response policy Security and privacy incident response policies are documented and communicated to authorised users.
• Incident management Incidents are logged, tracked, resolved, and communicated to affected parties through the Incident and Corrective Action Log.
• Backup and restoration Critical systems and data are backed up to encrypted, redundant storage and are tested for recovery.
• Risk management programme A documented risk management programme covers threat identification, risk rating, and mitigation. Risks are reviewed during ISMS management reviews.

GenieAI actúa como encargado del tratamiento. Tú sigues siendo el responsable de cualquier dato personal o confidencial que subas. Cumplimos el RGPD del Reino Unido y la Data Protection Act 2018.

• Data retention and disposal Formal procedures govern the retention and secure disposal of company and customer data.
• Data classification policy A data classification policy ensures confidential data is properly secured and restricted to authorised personnel.
• Data subject rights Processes are in place to handle access, rectification, erasure, and objection requests within statutory timeframes.
• Data export and deletion on exit On contract termination customer data can be returned or securely deleted in line with the customer agreement.