1. Purpose
Audit Docs holds supplier audit reports, quality documents, and risk findings that our customers rely on to make decisions about product quality and regulatory compliance. This Information Security Policy sets out how Audit Docs protects that information, and the systems that store and process it, from unauthorized access, loss, alteration, and disruption.
The policy has three goals. We protect the confidentiality of customer and company information so that only authorized people can see it. We protect its integrity so that records are accurate and cannot be changed without detection. We protect its availability so that customers can reach their records when they need them.
2. Scope
This policy applies to all Audit Docs employees, contractors, and service providers who access our information or systems. It covers all information that we create, receive, store, or transmit, including customer content, personal data, source code, business records, and credentials. It applies to every system and device used for Audit Docs business, including the production platform, cloud infrastructure, corporate laptops, and approved personal devices.
3. Roles and responsibilities
The management of Audit Docs is accountable for approving this policy, providing the resources to carry it out, and reviewing its performance. The Information Security Lead, Srinivasa Rao, Director, is responsible for maintaining the policy, running the security program, advising teams, and reporting to management on risks and incidents. System and data owners are responsible for classifying their information and approving who may access it. All staff and contractors are responsible for following this policy, completing security training, and reporting suspected incidents right away.
4. Risk management
We identify, assess, and treat information security risks in a structured way. The Information Security Lead keeps a risk register that records each significant risk, how likely it is and how serious its impact would be, the controls in place, and who owns it. We review the register at least once a year and whenever there is a major change to our systems, suppliers, or business. Risks that are above our agreed tolerance must have a treatment plan with an owner and a deadline.
5. Information classification and handling
We classify information so that it receives the protection it needs. The four levels we use are:
Public: information that is approved for release, such as marketing material.
Internal: information for staff use that would cause minor harm if disclosed.
Confidential: information that would cause significant harm if disclosed, including internal financial records and security configurations.
Restricted: the most sensitive information, including customer content, audit reports, personal data, authentication secrets, and encryption keys.
Customer content is always treated as Restricted. Restricted information must be encrypted, shared only on a need-to-know basis, and never copied to personal accounts, removable media, or unapproved tools.
6. Access control
Access to systems and data is granted on the principle of least privilege, which means people receive only the access that their role requires. Access requests must be approved by the system or data owner and recorded. We review user access to production systems at least every quarter and remove anything that is no longer needed. Access is removed on the day a person leaves Audit Docs or changes to a role that no longer needs it.
Staff must use multi-factor authentication for all systems that support it, including email, cloud consoles, source code repositories, and administrative tools. Shared accounts are not allowed. Privileged and administrative access is limited to named individuals, is used only when needed, and is logged.
Customers sign in to the platform with one-time six digit codes sent to their work email address. These codes are short-lived, can be used only once, and are protected against repeated guessing by rate limiting and lockouts.
7. Encryption and key management
Customer content and other Restricted information is encrypted in transit using current versions of TLS and is encrypted at rest using strong, industry-accepted algorithms. Encryption keys and other secrets are stored in a dedicated secrets or key management service, never in source code or shared documents. Access to keys is limited to the people and services that need it, and keys are rotated on a defined schedule and immediately if they are suspected to have been exposed.
8. Secure development and change management
We build security into the way we develop software. All code changes are reviewed by at least one other engineer before they are released, and they are tracked in version control. We scan our code and its dependencies for known vulnerabilities and fix serious issues promptly. We keep development, testing, and production environments separate, and we do not use real customer data in development or testing without approval and appropriate protection.
Changes to production systems follow a documented process that includes review, testing, approval, and a plan for rolling the change back if it fails. Emergency changes are allowed where needed to protect the service, and are reviewed afterward.
9. Vulnerability and patch management
We scan our systems regularly for vulnerabilities and apply security updates in a timely way. As a guide, we aim to fix critical vulnerabilities within 10 days, high-severity vulnerabilities within 30 days, and others within 90 days of discovery, and we document any exceptions and the extra controls used in the meantime. We arrange independent penetration testing of the platform at least once a year and track every finding to resolution.
10. Logging and monitoring
We keep logs of important security events, including sign-ins, failed sign-in attempts, administrative actions, access to customer content, and changes to configuration and permissions. Logs are protected against tampering, kept for at least 12 months, and reviewed using automated alerts for suspicious activity. This logging also supports the audit trails that our customers need to show how supplier decisions were made.
11. Network and infrastructure security
Our production systems run in reputable cloud environments that hold recognized security certifications. We use firewalls and network segmentation to limit traffic to what is needed, we keep administrative interfaces off the public internet, and we apply secure baseline configurations to servers and services. We monitor our infrastructure for unusual activity and check configuration regularly for drift from the approved baseline.
12. Device and workplace security
Company laptops and other devices used for Audit Docs work must have full-disk encryption, a screen lock, current security updates, and endpoint protection. Personal devices may be used only if they meet the same standards and are approved by the Information Security Lead. Lost or stolen devices must be reported immediately so that access can be revoked and data can be wiped if necessary. Staff must not leave devices or documents unattended in public places, and must not discuss confidential matters where they can be overheard.
13. Backup and business continuity
Customer content and critical systems are backed up automatically and the backups are encrypted and stored separately from the primary systems. We test restoration of backups at least once a year. We maintain a business continuity and disaster recovery plan that sets out how we would restore the service after a serious disruption, with target recovery time of 90 days. We test the plan at least once a year and update it after each test.
14. Supplier and third-party security
Before we use a supplier that will handle our information or systems, we assess its security, and we require written agreements that include confidentiality, security, and breach notification obligations. We keep a list of our suppliers, review the most important of them at least once a year, and end relationships that no longer meet our standards. Suppliers receive access only to the information they need and only for as long as they need it.
15. Security incident management
Anyone who suspects a security incident, such as unauthorized access, lost data, malware, or a lost device, must report it immediately to operations@audit-docs.com. The Information Security Lead will assess each report, assign a severity, and lead the response, which includes containing the problem, removing its cause, restoring normal service, and recording what happened.
If an incident affects customer content or personal data, we will notify the affected customers without undue delay, and in any case within the time required by law and by our agreements, and we will notify regulators where required. After every serious incident, we hold a review to learn what went wrong and record the improvements we will make.
16. Personal data and privacy
We protect personal data in line with our Privacy Policy and with applicable data protection laws, including India's Digital Personal Data Protection Act, 2023, and other laws that apply to our customers. We collect and keep only the personal data we need, limit who can see it, and delete it when it is no longer required. Customers may ask us how their personal data is handled by contacting operations@audit-docs.com.
17. Security awareness and training
All new staff and contractors receive security training when they join, and everyone repeats it at least once a year. Training covers recognizing phishing, handling Restricted information, protecting passwords and devices, and reporting incidents. People with special responsibilities, such as engineers and administrators, receive additional role-specific training. Staff are bound by confidentiality obligations in their contracts, and background checks are carried out where the law permits and the role requires.
18. Acceptable use
Company systems and information are provided for business purposes. Staff must not install unapproved software, disable security controls, access information they are not authorized to see, or use company systems for unlawful or abusive activity. Staff must not share credentials, and must lock their screens when they step away.
19. Compliance, monitoring, and review
We comply with the laws, regulations, and contractual commitments that apply to our information security. We carry out internal reviews of our controls at least once a year and welcome independent audits and customer security questionnaires. We are working toward alignment with recognized frameworks such as ISO/IEC 27001. Management reviews the policy and the performance of the security program at least once a year, and after any significant incident or change.
20. Exceptions and enforcement
Any exception to this policy must be requested in writing, assessed for risk, approved by the Information Security Lead, and given an end date. Breaches of this policy may lead to disciplinary action, which can include termination of employment or contract, and may be reported to the authorities where the law requires.
21. Document control
This policy is reviewed at least once a year and whenever there is a significant change in our business, technology, or risks. The current version is published to all staff, and a summary is available to customers on request at operations@audit-docs.com.
22. Contact us
For questions about this policy or to report a security concern, please contact:
Email: operations@audit-docs.com