Sicurezza GenieAI
protezione di livello enterprise per i tuoi dati legali

La piattaforma Genie è ospitata su Amazon Web Services. L'accesso all'ambiente di produzione è limitato al personale autorizzato, monitorato e protetto da autenticazione a più fattori, esclusivamente tramite connessioni cifrate.

• Encryption key access restricted Privileged access to encryption keys is restricted to authorised users with a business need.
• Unique account authentication Authentication to systems and applications uses unique credentials or authorised SSH keys.
• Production application access restricted System access is restricted to authorised personnel only.
• Production database access restricted Privileged database access is restricted to authorised users with a business need.
• Firewall access restricted Privileged firewall access is restricted to authorised users with a business need.
• Production OS access restricted Privileged operating system access is restricted to authorised users with a business need.
• Production network access restricted Privileged production network access is restricted to authorised users with a business need.
• Unique network system authentication Production network authentication uses unique credentials or authorised SSH keys.
• Remote access MFA enforced Production systems are remotely accessible only by authorised employees with a valid multi-factor authentication method.
• Remote access encrypted Production systems are remotely accessible only via approved encrypted connections.
• Infrastructure performance monitored Monitoring tools watch systems and infrastructure and generate alerts when predefined thresholds are met.
• Network firewalls utilised Firewalls are configured to prevent unauthorised access.
• Network and system hardening Hardening standards are documented, follow industry best practice, and are reviewed at least annually.

I controlli su persone e processi che accompagnano il livello tecnico: codice di condotta sottoscritto, policy sulle password applicata, dispositivi gestiti centralmente, formazione annuale sulla sicurezza e revisioni trimestrali degli accessi.

• Production inventory maintained A formal inventory of production system assets is kept up to date.
• Code of Conduct acknowledged Employees acknowledge a Code of Conduct at hire. Violations are subject to a documented disciplinary policy.
• Password policy enforced Passwords for in-scope system components are configured according to a documented Password Policy.
• MDM system in use A mobile device management system centrally manages company-issued devices supporting the service.
• Security awareness training All staff complete information security and acceptable use training at onboarding, refreshed at least annually.
• Joiner, mover, leaver process Access is granted by role and removed promptly when personnel leave or change roles. Quarterly access reviews are recorded in the Access Rights Review Log.

Crittografia, monitoraggio e sviluppo sicuro integrati nella piattaforma. I dati dei clienti sono cifrati a riposo con AES-256 e in transito con TLS 1.2 o superiore, e ogni modifica al codice è revisionata da un collega prima del rilascio.

• Data encryption at rest Datastores housing sensitive customer data are encrypted at rest using AES-256 or equivalent.
• Data transmission encrypted Confidential and sensitive data is transmitted over public networks using TLS 1.2 or higher.
• Control self-assessments Self-assessments are performed at least annually to verify controls remain effective. Findings are tracked to closure within an SLA.
• Vulnerability and system monitoring Vulnerability management and system monitoring are documented, with internal scanning supplemented by independent penetration testing following significant changes.
• Secure software development All code changes are peer reviewed and tested. Deployment is separated from development so only authorised release managers ship to production.
• Environment segregation Development, test, staging, and production environments are logically separated.

Procedure documentate per i momenti che contano di più. Risposta agli incidenti, continuità operativa, backup e gestione del rischio sono affidati a ruoli nominati all'interno dell'SGSI.

• Continuity and disaster recovery A documented Business Continuity and Disaster Recovery Plan defines recovery priorities, communication paths, and a recovery time objective of one hour for critical services.
• Management roles defined Named roles inside the ISMS oversee the design and implementation of information security controls.
• Incident response policy Security and privacy incident response policies are documented and communicated to authorised users.
• Incident management Incidents are logged, tracked, resolved, and communicated to affected parties through the Incident and Corrective Action Log.
• Backup and restoration Critical systems and data are backed up to encrypted, redundant storage and are tested for recovery.
• Risk management programme A documented risk management programme covers threat identification, risk rating, and mitigation. Risks are reviewed during ISMS management reviews.

GenieAI agisce come responsabile del trattamento. Tu resti titolare per qualsiasi dato personale o riservato che carichi. Rispettiamo il GDPR del Regno Unito e il Data Protection Act 2018.

• Data retention and disposal Formal procedures govern the retention and secure disposal of company and customer data.
• Data classification policy A data classification policy ensures confidential data is properly secured and restricted to authorised personnel.
• Data subject rights Processes are in place to handle access, rectification, erasure, and objection requests within statutory timeframes.
• Data export and deletion on exit On contract termination customer data can be returned or securely deleted in line with the customer agreement.