Sécurité GenieAI
une protection de niveau entreprise pour vos données juridiques

La plateforme Genie est hébergée sur Amazon Web Services. L'accès à la production est restreint au personnel autorisé, surveillé, et protégé par une authentification multifacteur, uniquement via des connexions chiffrées.

• Encryption key access restricted Privileged access to encryption keys is restricted to authorised users with a business need.
• Unique account authentication Authentication to systems and applications uses unique credentials or authorised SSH keys.
• Production application access restricted System access is restricted to authorised personnel only.
• Production database access restricted Privileged database access is restricted to authorised users with a business need.
• Firewall access restricted Privileged firewall access is restricted to authorised users with a business need.
• Production OS access restricted Privileged operating system access is restricted to authorised users with a business need.
• Production network access restricted Privileged production network access is restricted to authorised users with a business need.
• Unique network system authentication Production network authentication uses unique credentials or authorised SSH keys.
• Remote access MFA enforced Production systems are remotely accessible only by authorised employees with a valid multi-factor authentication method.
• Remote access encrypted Production systems are remotely accessible only via approved encrypted connections.
• Infrastructure performance monitored Monitoring tools watch systems and infrastructure and generate alerts when predefined thresholds are met.
• Network firewalls utilised Firewalls are configured to prevent unauthorised access.
• Network and system hardening Hardening standards are documented, follow industry best practice, and are reviewed at least annually.

Les contrôles humains et procéduraux qui accompagnent la couche technique : code de conduite signé, politique de mots de passe appliquée, appareils gérés de façon centralisée, formation annuelle à la sécurité et revues d'accès trimestrielles.

• Production inventory maintained A formal inventory of production system assets is kept up to date.
• Code of Conduct acknowledged Employees acknowledge a Code of Conduct at hire. Violations are subject to a documented disciplinary policy.
• Password policy enforced Passwords for in-scope system components are configured according to a documented Password Policy.
• MDM system in use A mobile device management system centrally manages company-issued devices supporting the service.
• Security awareness training All staff complete information security and acceptable use training at onboarding, refreshed at least annually.
• Joiner, mover, leaver process Access is granted by role and removed promptly when personnel leave or change roles. Quarterly access reviews are recorded in the Access Rights Review Log.

Chiffrement, surveillance et développement sécurisé intégrés à la plateforme. Les données client sont chiffrées au repos en AES-256 et en transit en TLS 1.2 ou supérieur, et chaque modification de code est relue par un pair avant mise en production.

• Data encryption at rest Datastores housing sensitive customer data are encrypted at rest using AES-256 or equivalent.
• Data transmission encrypted Confidential and sensitive data is transmitted over public networks using TLS 1.2 or higher.
• Control self-assessments Self-assessments are performed at least annually to verify controls remain effective. Findings are tracked to closure within an SLA.
• Vulnerability and system monitoring Vulnerability management and system monitoring are documented, with internal scanning supplemented by independent penetration testing following significant changes.
• Secure software development All code changes are peer reviewed and tested. Deployment is separated from development so only authorised release managers ship to production.
• Environment segregation Development, test, staging, and production environments are logically separated.

Des procédures documentées pour les moments qui comptent le plus. Réponse aux incidents, continuité d'activité, sauvegardes et gestion des risques relèvent chacune d'un rôle nommé au sein du SMSI.

• Continuity and disaster recovery A documented Business Continuity and Disaster Recovery Plan defines recovery priorities, communication paths, and a recovery time objective of one hour for critical services.
• Management roles defined Named roles inside the ISMS oversee the design and implementation of information security controls.
• Incident response policy Security and privacy incident response policies are documented and communicated to authorised users.
• Incident management Incidents are logged, tracked, resolved, and communicated to affected parties through the Incident and Corrective Action Log.
• Backup and restoration Critical systems and data are backed up to encrypted, redundant storage and are tested for recovery.
• Risk management programme A documented risk management programme covers threat identification, risk rating, and mitigation. Risks are reviewed during ISMS management reviews.

GenieAI agit en qualité de sous-traitant. Vous restez responsable du traitement pour toute donnée personnelle ou confidentielle que vous téléversez. Nous respectons le RGPD britannique et le Data Protection Act 2018.

• Data retention and disposal Formal procedures govern the retention and secure disposal of company and customer data.
• Data classification policy A data classification policy ensures confidential data is properly secured and restricted to authorised personnel.
• Data subject rights Processes are in place to handle access, rectification, erasure, and objection requests within statutory timeframes.
• Data export and deletion on exit On contract termination customer data can be returned or securely deleted in line with the customer agreement.