Circular Software IT Security Policy / 2025

 1. Purpose

• To ensure the confidentiality, integrity and availability of Circular Software’s systems, code and customer data by definingclear security responsibilities and controls.

2. Scope

• Applies to all company personnel (the soledirector/employee and any contractors), all systems, code repositories and environments used to develop, deploy and support Circular Software’s AdobeInDesign app/plugin.

3. Roles & Responsibilities

• Director (Security Owner): Overall accountability for security, approves changes, conducts reviews.
• Contractors: Must comply with this policy, complete security training, and follow secure development practices.
• Third‐party Providers (e.g. AWS, GitHub, Webflow, Dropbox): Must maintain their own security certifications and controls as per their published policies.

4. Human Resource Security

• Onboarding: All new contractors undergo reference and background checks (including DBS/security vetting).
• Training: security awareness training via LinkedIn Learning (covering OWASP Top Ten, phishing, secure coding).
• Offboarding: Documented process to disable all system accounts, revoke keys/badges, and collect company assets, secure disposal of data/assets if required.
• Confidentiality: All personnel sign NDAs and confidentiality clauses in contracts.

5. Asset Management

• Inventory: Maintain an inventory of coderepositories, cloud resources, API keys and development tools.
• Classification: Code classified as“Confidential,” encrypted at rest and in transit.

6. Access Control

• Least Privilege: Access to production and development environments granted on a need-to-know basis.
• Multi-factor authentication enforced on all systems (GitHub, Webflow, Airtable, Dropbox, email, VPN).
• Strong password requirements (minimum 12characters, complexity).
• Account Lockout: Automatic lockout after fiveunsuccessful login attempts; account unlock via director.

7. Cryptography

• Data at Rest: Cloud provider encryption(AES-256) for all storage volumes and backups.

8. System Development & Maintenance

• Secure Development:
• Follow OWASP Secure Coding Practices.
• Peer review of all code changes; use pullrequests on private GitHub.
• Change Management:
• All changes logged in our project tracker.
• Stakeholders notified of any changes that could affect functionality or security.
• Vulnerability Management:
  
• Weekly automated vulnerability scans of all code and cloud infrastructure.
• Critical findings remediated within 72 hours; tracked in issue tracker.

9. Network & Infrastructure Security

• Firewalls: Software and hardware firewallsenforce network segmentation between development, test and production systems.
• VPN: Mandatory for all remote access to internalcloud resources.
• IDS/IPS: Not deployed (low-traffic, cloud-onlyenvironment); cloud provider’s managed threat detection is relied upon.

10. Supplier & Third-Party Security

• Due Diligence: Only engage cloud and service providers with published security certifications (e.g., ISO 27001, SOC 2).
• Contracts: review provider policies annually.

11. Monitoring & Logging

• Audit Logs: Enable system-level logs for all environments.
• Retention: Logs retained for 90 days for incident investigation.
• Review: Director reviews critical logs monthly.

12. Incident Response & Business Continuity

• Incident Response Plan: Documented steps fordetection, containment, eradication, recovery and lessons learned.
• Notification: Customers notified within 24 hoursof any incident with potential customer impact.
• Backups: Weekly full backups of databases and code repositories.
• Stored in a separate cloud region; restore tested semi-annually.
• Disaster Recovery: in event of major outage,systems can be rebuilt from code and backups within 24 hours.

13. Compliance & Review

• Compliance: This policy aligns with industrybest practices; no formal certification due to company size.
• Review Cycle: Policy reviewed and updatedannually or after any major change in environment or personnel.

‍