1. Purpose
This policy outlines the information security standards and practices followed by Gridcheck to protect customer data, internal systems, and employee access from unauthorized use, disclosure, alteration, and destruction.
2. Scope
This policy applies to all team members, contractors, and systems involved in the operation, development, or administration of Gridcheck and its infrastructure.
3. Roles and Responsibilities
- Cliff Hanks – Business Continuity and Security Lead
- Angela Jones – Operations and Compliance Oversight
- All team members – Responsible for following security protocols and reporting concerns
4. Access Control
- Access to systems is granted based on role and job necessity (principle of least privilege).
- All accounts are protected by strong passwords and Multi-Factor Authentication (MFA).
- Former team members have access promptly removed upon separation.
5. Encryption and Data Protection
- All data is encrypted in transit (TLS) and at rest using secure AWS services.
- Customer data is never stored on local devices or shared outside of authorized tools.
- Emails and SMS messages use SendGrid and Twilio with scoped access and API key restrictions.
6. Remote Work and Physical Security
- All work is conducted on encrypted, password-protected devices.
- Team members are required to lock screens when away and protect physical access in their home work environments.
- No paper records containing sensitive data are permitted outside of secure destruction.
7. Incident Response
In the event of a suspected data breach or security incident, our documented Data Breach Response Plan will be followed. All incidents are logged, investigated, and followed by a post-mortem review and any needed security updates.
8. Policy Review
This policy is reviewed at least annually or when a material change in operations or technology occurs.
Last reviewed: July 22, 2025