Security you can rely on

We maintain a robust vulnerability management program that includes automated and manual scanning of systems and applications, regular security assessments and integration of threat intelligence to detect emerging risks.

Identified vulnerabilities are prioritized based on severity, exploitability and business impact. We apply patches promptly, implement compensating controls when needed and track remediation through to resolution.

We continuously monitor our systems, networks and applications for signs of suspicious activity, performance anomalies and potential security threats. Our monitoring infrastructure integrates automated alerting, log analysis and threat detection to provide real-time visibility across our environment.

In the event of a security incident, we follow a structured incident response plan designed to contain, investigate and remediate the issue swiftly. Our incident management process includes clear escalation paths, cross-functional coordination, root cause analysis and post-incident reviews. We are committed to transparency and, when appropriate, provide timely notifications to affected stakeholders, in accordance with regulatory and contractual obligations.

We carefully assess and manage the security and privacy risks associated with our third-party vendors and service providers. All third parties undergo a risk-based evaluation process that includes due diligence, contractual safeguards and security assessments that are aligned with industry standards.

We ensure that our vendors implement appropriate technical and organizational measures to protect data and maintain service integrity. Ongoing monitoring, regular reassessments and audit rights help us maintain visibility into the evolving risk landscape.

We implement strict access management controls to ensure that only authorized users have access to our systems and sensitive data. Our access policies are based on the principle of least privilege, meaning users are granted the minimum necessary access to perform their job functions.

Access rights are regularly reviewed and updated based on role changes, project requirements and security policies. We employ multi-factor authentication (MFA) for an added layer of security and we enforce strong password policies. Additionally, access to critical systems is closely monitored and logged, to detect any unauthorized attempts or suspicious activities.

Our storage is encrypted by default* using strong encryption standards to protect sensitive data from unauthorized access. This ensures that all sensitive information remains secure, even in the event of a storage media compromise. Data transmitted between systems or across networks is encrypted by using secure protocols, such as TLS, to protect it from interception or tampering during transmission.