Security & Compliance
Skeleton — every section below is a question, not an answer. Replace each prompt with what is actually true of your practice. Do not claim a certification you do not hold, or a control you have not implemented: this is the page enterprise procurement reads, and a claim that fails a security questionnaire costs more than having no page at all.
How INFIEONE Solutions protects the systems and data entrusted to us.
Certifications and audits
Which standards do you actually hold — ISO 27001, SOC 2 Type II, PCI DSS, CMMI? Who issued each, when, and when does it lapse? If you are working towards one rather than holding it, say so in those words. Add each to Header & Footer → Certifications so the badge and this page agree.
Data protection
How is client data encrypted in transit and at rest, and with what? Where is it physically stored, and in which jurisdictions? How is it separated between clients? What happens to it when an engagement ends?
Access control
Who can reach client systems, and on what basis? Is multi-factor authentication enforced? How is access reviewed, and how quickly is it revoked when someone leaves? Are privileged actions logged?
Resilience and recovery
How often are backups taken, where are they held, and when did you last restore from one to prove it works? State your recovery time and recovery point objectives if you commit to them contractually.
Incident response
Who is on call, and how fast do you respond? Within what period do you notify an affected client of a breach? Is that timeline in your contracts? Buyers will ask for the number, so publish the one you can meet.
People and process
Are staff background-checked? Do they sign confidentiality agreements? What security training do they receive, and how often? How is code reviewed and dependencies patched?
Sub-processors
Which third parties can touch client data — cloud providers, monitoring, support tooling? List them. Procurement will ask, and a published list saves a round of questions on every deal.
Reporting a vulnerability
Give a monitored address for security reports, say how quickly you acknowledge them, and state that you will not pursue good-faith researchers. This section is cheap to write and is often the first thing a technical buyer looks for.
Questionnaires and documentation
Say who to contact for a security questionnaire, an audit report or a DPA, and what you can share under NDA. Contact: contact@infieone.com.