Security Policy

Last Updated: January 7, 2025

This Security Policy describes the measures Assthree takes to protect the integrity, confidentiality, and availability of user data and platform infrastructure. By using our services, you acknowledge that you have read and understood this policy.

1. Scope

This policy applies to all systems, services, and data managed by Assthree, including our web platform, application programming interfaces, internal tools, and any third-party services integrated into our infrastructure. It covers all users, employees, contractors, and partners who interact with our systems.

2. Data Protection

2.1 Data Encryption

All data transmitted between users and our platform is encrypted using industry-standard Transport Layer Security (TLS). Sensitive data stored within our systems is encrypted at rest using strong encryption algorithms. Encryption keys are managed through dedicated key management processes and are rotated on a regular schedule.

2.2 Data Minimisation

We collect only the data necessary to deliver and improve our services. Data that is no longer required for its original purpose is securely deleted or anonymised in accordance with our data retention procedures.

2.3 Access Controls

Access to user data and internal systems is restricted on a need-to-know basis. Role-based access controls are enforced across all internal platforms. Administrative access requires multi-factor authentication and is subject to periodic review and audit.

3. Infrastructure Security

3.1 Network Security

Our infrastructure is protected by firewalls, intrusion detection systems, and continuous network monitoring. Traffic is filtered and inspected to identify and block malicious activity. Sensitive internal services are isolated from public-facing systems through network segmentation.

3.2 Server and Application Hardening

All servers and application environments are configured according to established security hardening standards. Unnecessary services, ports, and protocols are disabled. Operating systems and software dependencies are kept up to date with security patches applied in a timely manner.

3.3 Vulnerability Management

We conduct regular vulnerability assessments and penetration testing of our systems. Identified vulnerabilities are prioritised and remediated according to their severity. Critical vulnerabilities are addressed as a matter of urgency.

4. Application Security

4.1 Secure Development Practices

Our development team follows secure coding guidelines throughout the software development lifecycle. Code reviews, static analysis, and automated security testing are incorporated into our build and deployment processes. Security considerations are evaluated at each stage of feature development.

4.2 Authentication and Session Management

User authentication is enforced through secure mechanisms including hashed password storage and support for multi-factor authentication. Session tokens are generated securely, expire after periods of inactivity, and are invalidated upon logout. Brute-force and credential stuffing attempts are detected and mitigated automatically.

4.3 Input Validation and Output Encoding

All user-supplied input is validated and sanitised before processing. Output is encoded appropriately to prevent injection attacks including cross-site scripting and SQL injection. Security headers are applied to all HTTP responses.

5. Third-Party Services

We evaluate the security practices of third-party providers before integration. Contracts with service providers include appropriate data protection and security obligations. Third-party access to our systems and data is limited to what is strictly necessary and is subject to ongoing review.

6. Incident Response

6.1 Detection and Response

We maintain an incident response plan that defines procedures for detecting, containing, and recovering from security incidents. Our systems generate logs and alerts that are monitored continuously. Upon detection of a security incident, our response team is engaged immediately to assess and address the situation.

6.2 Notification

In the event of a security incident that affects user data, we will notify affected users and relevant parties without undue delay. Notifications will include a description of the incident, the data involved, the steps taken to address it, and guidance for affected users where applicable.

7. Physical Security

Our services are hosted in data centres that maintain physical access controls including restricted entry, surveillance systems, and environmental protections. Physical access to server infrastructure is limited to authorised personnel only.

8. Employee Security

All employees and contractors with access to systems or data receive security awareness training. Background screening is conducted for roles with elevated access privileges. Security responsibilities are clearly defined and communicated across the organisation. Employees are required to comply with internal security policies and report suspected incidents promptly.

9. Business Continuity and Disaster Recovery

We maintain backup and recovery procedures to ensure continuity of service in the event of system failure or disruption. Backups are performed regularly, stored securely, and tested periodically to verify their integrity and restorability. Recovery time objectives are defined and reviewed as part of our continuity planning.

10. Responsible Disclosure

We welcome reports from security researchers and users who identify potential vulnerabilities in our platform. If you believe you have discovered a security issue, please contact us at contact@assthree.com with a detailed description. We ask that you refrain from publicly disclosing the issue until we have had a reasonable opportunity to investigate and address it. We are committed to working with reporters in good faith and will acknowledge valid reports promptly.

11. Policy Review

This Security Policy is reviewed on a regular basis and updated to reflect changes in our practices, technology, or applicable standards. Continued use of our services following any update constitutes acceptance of the revised policy. We encourage users to review this page periodically.

12. Contact

If you have questions or concerns regarding this Security Policy, please contact us:

Assthree
108 Harry Galaun Dr, Carlswald, Midrand, 1686, South Africa
Phone: +27216833649
Email: contact@assthree.com
Website: assthree.com