Data Security Policy – Effective Date: 17 July 2025

1. Data Classification

We classify data based on sensitivity levels:

• Confidential: Data that requires strict access controls and protection measures.
• Sensitive: Data that is considered personally identifiable or sensitive in nature.
• Public: Data that can be freely shared without compromising security.

2. Access Control Procedures

• We implement strong password policies, including requiring a minimum password length, complexity, and regular changes.
• Two-factor authentication (2FA) is mandatory for all user accounts.
• Access to data is granted on a need-to-know basis, with role-based access controls in place.
• Regular reviews of access privileges are conducted to ensure they remain appropriate.

3. Encryption Practices

• Data is encrypted both in transit and at rest using industry-standard encryption algorithms.
• We maintain secure data centers and servers with physical access controls.

4. Third-Party Access

• We allow third-party vendors or partners to access our data only when necessary for the provision of services.
• Third-party vendors are subject to strict data privacy and security agreements.

5. Employee Training

• Our employees receive regular training on data security best practices, including:
  • Identifying and reporting security threats
  • Handling sensitive data appropriately
  • Following secure coding practices
  • Understanding incident response procedures

6. Incident Response Plan

• We have a comprehensive incident response plan in place to address security breaches and vulnerabilities.
• Our plan includes steps for identifying, containing, investigating, and remediating security incidents.
• We have designated personnel responsible for handling security incidents.

7. Security Audits and Assessments

• We conduct regular security audits and assessments to identify and address potential vulnerabilities.  
• Audits are performed by qualified security professionals.
• Remediation measures are implemented promptly to address any identified issues.

8. Compliance with Industry Standards

• We comply with applicable industry standards and regulations, including ISO/IEC 27001, SOC 2, GDPR, and NIST Cybersecurity Framework.

By using the Crux Ops CRM Service, you acknowledge that we have implemented reasonable security measures to protect your data.