Security policy

1. Scope

It applies to the ao3ti.com site and to the services AO3TI implements, hosts or manages, such as the AO3TI Helpdesk and process automations.

2. Encryption

• All site and service traffic travels encrypted over HTTPS (TLS).
• Administrative connections to the servers go through an encrypted private network, not the open internet.

3. Access control

• Each person has their own account and only the permissions they need for their work.
• Two-factor authentication is available for agents in the Helpdesk.
• Administration panels are not publicly exposed.
• We revoke access when a person no longer needs it.

4. Infrastructure

• Services run in containers isolated from one another.
• Behind a proxy and a protection network that filter malicious traffic.
• We apply system and application security updates periodically.

5. Backups and continuity

Services hosted by AO3TI have periodic backups and procedures to restore them after a failure.

6. Logging and monitoring

We log service execution and relevant events to detect failures or misuse. Logs are kept only as long as necessary.

7. Confidentiality

Everyone who works with AO3TI commits to keeping client information confidential, including after their relationship with us ends.

8. Security incidents

If an incident affects personal data, we contain it, assess its scope and notify the affected clients and the competent authority, within the time limits and conditions set by the LOPDP.

9. Vulnerability reporting

If you find a vulnerability in our site or services, write to [email protected] with the details. Please do not exploit or disclose it until we have fixed it.

10. Shared responsibility

Each client is responsible for protecting its own credentials, assigning the right permissions to its team and letting us know if it suspects unauthorised access.