Information Security Policy

Purpose

This policy sets the baseline security requirements that apply across Hybrowlabs. It covers the information we hold and handle — our customers' business data, our own company records, employee information, and the systems we operate to deliver our services.

Scope

The policy applies to everyone who works for or on behalf of Hybrowlabs, including employees and contractors. It also applies to every system used to create, access, process, store, transmit, or administer company or customer information: applications, devices, code repositories, cloud services, and the third parties we engage.

Security objectives

• Protect the confidentiality, integrity, and availability of the information in our care.
• Limit access to authorised users, based on a clear business need.
• Keep our development, deployment, monitoring, and incident response practices secure.
• Meet the contractual, legal, and regulatory obligations attached to the services we deliver.
• Maintain evidence that our controls are working, so customers can verify it.

Governance and responsibilities

• Management approves the security direction, assigns owners to each control area, and makes sure the work is properly resourced.
• Security and operations owners maintain the policies, run the review cycle, track risks, and support customers through due-diligence and audit.
• Engineering and delivery teams put the required controls into practice — in the applications they build, the infrastructure they run, the repositories they work in, and the support processes they follow.
• Everyone is responsible for meeting the confidentiality, acceptable-use, access-control, and incident-reporting requirements set out in this policy and the ones beneath it.

Core policy requirements

• Information is classified and handled according to its sensitivity.
• Access is granted through documented authorisation and removed once it is no longer needed.
• Customer data is used only for approved business purposes.
• Security events and suspected incidents are reported promptly.
• Changes to production or customer-impacting systems follow change control.
• Vulnerabilities are triaged, remediated, and validated according to severity.
• Policies and supporting evidence are reviewed at least annually, and sooner if something material changes.

Evidence maintained

• Approved policy documents
• Access review records
• Risk register
• Security review minutes
• Incident records
• Vulnerability tracker
• Change approvals