TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

Version 1.00

Last Updated: 31^st October 2022

1. Introduction

The following is a description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, considering the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

2. Certifications and Attestations

• Inventrax maintains sufficient controls to meet the objectives stated in ISO 27001 (or equivalent standards) and any other industry standards applicable to Inventrax, including any mandatory standards required by Data Protection Laws (collectively the “Industry Standards”) for the information security management systems supporting the Services.
• At least once per calendar year, Inventrax performs an assessment against such Industry Standards (“Assessment”). Upon the Customer’s written request, which shall be no more than once per calendar year, Inventrax may provide a summary of the Assessment(s) to the Customer. Assessments shall be Confidential Information of Inventrax.                                                               

3. Physical Security Measures

• Systems, Machines, and Devices. 

Inventrax has (i) Physical protection mechanisms; and (ii) entry controls to limit physical access.

• Media

Inventrax maintains processes designed for the: (i) Industry standard destruction of sensitive materials before disposition of media; (ii) secure safe for storing damaged hard disks prior to physical destruction; and (iii) physical or verified logical destruction of all decommissioned hard disks storing Personal Data.

4. Technical Security Measures

• Access Administration

Inventrax has protected access to the Services by its employees and contractor with authentication and authorization systems. Access to production and sub-production systems requires user authentication. Access rights are granted depending on work requirements and are terminated upon termination of employment or consultancy agreement. User account and password restrictions are included in the production infrastructure and are accessible by the administration.

• Access Controls

Inventrax implements and maintains appropriate access controls, including, without limitation, limiting access to Personal Data to the minimum number of Inventrax personnel who require such access in order to provide the Services. Inventrax provides its personnel with appropriate ongoing training regarding the protection of Personal Data and its Security Program and requires such personnel to comply with the Security Program.

• Logging and Monitoring.

Inventrax’s production infrastructure maintains logs of activities that are centrally collected, are secured in an effort to prevent tampering and are monitored for anomalies.

• Firewall system

In order to safeguard Inventrax’s systems, an industry-standard firewall has been set up and will be maintained. This firewall is present on the network and examines all incoming connections that are sent to Inventrax’s environment.

• Encryption

All Personal Data that is (i) transmitted over any public network or wirelessly; (ii) stored on laptops, other portable devices, or storage media; or (iii) stored on any device or media that is housed or transported outside of the physical or logical controls of Inventrax, is encrypted by Inventrax using Advanced Encryption Standard, other tools, and techniques in accordance with Data Protection Laws and Industry Standards HTTPS/TLS (1.2 or higher).

• Antivirus

Inventrax applies updates to anti-virus, anti-malware, and anti-spyware software at regular intervals.

• Confidentiality, Integrity, Availability, And Resilience of Processing Systems and Services

Inventrax’s customer agreements contain strict confidentiality obligations. Inventrax’s personnel and subcontractors authorized to Process Personal Data are subject to confidentiality obligations substantially equivalent to the ones Inventrax committed to in the Agreement or are under an appropriate statutory obligation of confidentiality. Inventrax has a business continuity plan designed to maintain service and/or recovery from reasonably foreseeable emergency situations or disasters. Customer Data is securely backed up on a regular basis. Inventrax infrastructure spans multiple fault-independent availability zones on its hosting provider and is supported by various tools and processes designed to maintain the availability and resiliency of Services.

• Change Control.

Changes to platform, applications and production infrastructure are evaluated to minimize risk and are implemented following applicable industry standards, leading best practices, and then-current applicable standard operating procedure.

5. Administrative Security Measures

• Personnel Security

Inventrax performs background screening on all employees and all contractors who have access to Personal Data, in accordance with applicable industry standards, leading best practices, then-current applicable standard operating procedures, and subject to applicable law.

• Security Awareness

Inventrax maintains a security awareness program that includes training of Inventrax employees on the Security Program. Training is conducted at the time of hire and periodically throughout employment at Inventrax.

6. Other Measures

• Inventrax shall be responsible for the security of Inventrax systems, and any Personal Data stored therein. Inventrax shall employ and maintain a reasonably comprehensive, written Security Program that complies with, and adequately addresses all relevant Data Protection Laws and Industry Standards.
• Inventrax’s Information Security Program covers all networks, systems, servers, computers, notebooks, laptops, PDAs, tablets, mobile phones, and other devices and media that Processes Personal Data or provide access to Inventrax’s systems.
• If during the term of the relevant Agreement, Inventrax modifies its Security Program in any manner that materially weakens or compromises the security, confidentiality, or integrity of any Personal Data, Inventrax shall promptly notify the Customer of any such material change.
• Inventrax shall conduct risk assessments of, and as necessary review and revise, its information security program at least annually, and whenever there is a material change in Inventrax’s business or technology practices that may reasonably affect the privacy, confidentiality, security, integrity, or availability of the Personal Data.
• Inventrax shall designate an individual as primarily responsible for the development, implementation, maintenance, and management of the Security Program.