Introduction
This Security Policy outlines the security measures and practices that are followed by all users and administrators of the Vryno CRM.
The policy aims to protect the confidentiality, integrity, and availability of data and systems within the Vryno CRM.
User Access Management
a) User accounts are created and managed following the principle of least privilege.
b) Users should authenticate using strong, unique passwords, and multi-factor authentication (MFA) should be enforced.
c) User access rights are reviewed regularly and promptly revoked upon termination or change in responsibilities.
Data Security
a) All data stored in the Vryno CRM is classified based on sensitivity and access requirements.
b) Encryption is used for data in transit and at rest, using industry-standard encryption algorithms.
c) Regular backups are performed to ensure data availability and recovery in case of data loss or system failure.
System and Network Security
a) All systems and networks are protected by up-to-date security mechanisms, including firewalls, intrusion detection/prevention systems, and antivirus software.
b) Regular vulnerability assessments and penetration testing are conducted to identify and address security weaknesses.
c) Critical patches and updates are applied promptly to mitigate known vulnerabilities.
Incident Response and Reporting
Security incidents should be reported promptly to the Data Protection Office (dpo@vryno.com) for investigation and remediation.
Physical Security
a) Physical access to our infrastructure, data centers, and other relevant facilities are restricted to authorized personnel only.
b) Adequate physical security controls, such as surveillance cameras, access control systems, and visitor registration, are in place.
Privacy and Compliance
a) Vryno CRM complies with applicable privacy laws and regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA).
b) Data privacy and protection measures, including data anonymization and data retention policies, are implemented and communicated to customers frequently via email.
Training and Awareness
a) Regular security awareness training is provided to all users and administrators to educate them about security best practices and the importance of data protection.
b) Users are informed about the potential risks and security threats associated with using the Vryno CRM.
Third-Party Risk Management
a) Third-party vendors or contractors providing services or accessing the Vryno CRM undergo a thorough assessment of their security controls.
b) Contracts with third parties include provisions for security and data protection requirements.
Policy Review and Updates
a) This Security Policy is reviewed periodically and updated as necessary to reflect changes in technology, security risks, and regulatory requirements.
b) Users and administrators are notified of any changes to the policy and provided with appropriate training or guidance.
