Segurança da GenieAI
proteção de nível empresarial para seus dados jurídicos

A plataforma Genie é hospedada na Amazon Web Services. O acesso à produção é restrito a pessoal autorizado, monitorado e protegido por autenticação multifator, apenas por conexões criptografadas.

• Encryption key access restricted Privileged access to encryption keys is restricted to authorised users with a business need.
• Unique account authentication Authentication to systems and applications uses unique credentials or authorised SSH keys.
• Production application access restricted System access is restricted to authorised personnel only.
• Production database access restricted Privileged database access is restricted to authorised users with a business need.
• Firewall access restricted Privileged firewall access is restricted to authorised users with a business need.
• Production OS access restricted Privileged operating system access is restricted to authorised users with a business need.
• Production network access restricted Privileged production network access is restricted to authorised users with a business need.
• Unique network system authentication Production network authentication uses unique credentials or authorised SSH keys.
• Remote access MFA enforced Production systems are remotely accessible only by authorised employees with a valid multi-factor authentication method.
• Remote access encrypted Production systems are remotely accessible only via approved encrypted connections.
• Infrastructure performance monitored Monitoring tools watch systems and infrastructure and generate alerts when predefined thresholds are met.
• Network firewalls utilised Firewalls are configured to prevent unauthorised access.
• Network and system hardening Hardening standards are documented, follow industry best practice, and are reviewed at least annually.

Os controles de pessoas e processos que acompanham a camada técnica: Código de Conduta assinado, política de senhas aplicada, dispositivos gerenciados centralmente, treinamento anual de segurança e revisões de acesso trimestrais.

• Production inventory maintained A formal inventory of production system assets is kept up to date.
• Code of Conduct acknowledged Employees acknowledge a Code of Conduct at hire. Violations are subject to a documented disciplinary policy.
• Password policy enforced Passwords for in-scope system components are configured according to a documented Password Policy.
• MDM system in use A mobile device management system centrally manages company-issued devices supporting the service.
• Security awareness training All staff complete information security and acceptable use training at onboarding, refreshed at least annually.
• Joiner, mover, leaver process Access is granted by role and removed promptly when personnel leave or change roles. Quarterly access reviews are recorded in the Access Rights Review Log.

Criptografia, monitoramento e desenvolvimento seguro integrados à plataforma. Os dados dos clientes são criptografados em repouso com AES-256 e em trânsito com TLS 1.2 ou superior, e cada alteração de código é revisada por pares antes do lançamento.

• Data encryption at rest Datastores housing sensitive customer data are encrypted at rest using AES-256 or equivalent.
• Data transmission encrypted Confidential and sensitive data is transmitted over public networks using TLS 1.2 or higher.
• Control self-assessments Self-assessments are performed at least annually to verify controls remain effective. Findings are tracked to closure within an SLA.
• Vulnerability and system monitoring Vulnerability management and system monitoring are documented, with internal scanning supplemented by independent penetration testing following significant changes.
• Secure software development All code changes are peer reviewed and tested. Deployment is separated from development so only authorised release managers ship to production.
• Environment segregation Development, test, staging, and production environments are logically separated.

Procedimentos documentados para os momentos que mais importam. Resposta a incidentes, continuidade de negócios, backups e gestão de riscos são responsabilidade de papéis nomeados dentro do SGSI.

• Continuity and disaster recovery A documented Business Continuity and Disaster Recovery Plan defines recovery priorities, communication paths, and a recovery time objective of one hour for critical services.
• Management roles defined Named roles inside the ISMS oversee the design and implementation of information security controls.
• Incident response policy Security and privacy incident response policies are documented and communicated to authorised users.
• Incident management Incidents are logged, tracked, resolved, and communicated to affected parties through the Incident and Corrective Action Log.
• Backup and restoration Critical systems and data are backed up to encrypted, redundant storage and are tested for recovery.
• Risk management programme A documented risk management programme covers threat identification, risk rating, and mitigation. Risks are reviewed during ISMS management reviews.

A GenieAI atua como operadora de dados. Você permanece o controlador de qualquer dado pessoal ou confidencial que enviar. Cumprimos o GDPR do Reino Unido e o Data Protection Act 2018.

• Data retention and disposal Formal procedures govern the retention and secure disposal of company and customer data.
• Data classification policy A data classification policy ensures confidential data is properly secured and restricted to authorised personnel.
• Data subject rights Processes are in place to handle access, rectification, erasure, and objection requests within statutory timeframes.
• Data export and deletion on exit On contract termination customer data can be returned or securely deleted in line with the customer agreement.