1. Purpose & scope.
The purpose of this policy is to protect the confidentiality, integrity, and availability of Avona Ltd's ("Avona") information assets, specifically customer financial data obtained via Finexer Ltd (Account Information Services).
This policy applies to all employees, contractors, and third-party vendors accessing Avona's infrastructure or data.
2. Governance & roles.
- Director: Ultimate accountability for information security and data protection (Data Controller).
- Head of Information Security: Responsible for technical implementation, cloud architecture, and vulnerability management.
- All Staff: Responsible for adhering to this policy and reporting security incidents immediately.
3. Infrastructure security.
Avona hosts its production environment exclusively within AWS in the London (eu-west-2) region. We employ a "Zero Trust" architecture:
- Network Security: All resources are deployed within a Virtual Private Cloud (VPC). Public access is restricted via Security Groups (Firewalls) to port 443 (HTTPS) only. Database ports are strictly whitelisted to internal application servers.
- Encryption:
- Data in Transit: All data transmission is encrypted via TLS 1.2+.
- Data at Rest: All databases (RDS), backups, and storage buckets (S3) are encrypted using AES-256 (AWS KMS).
- Access Control: Access to production infrastructure is restricted to key UK-based personnel via Multi-Factor Authentication (MFA).
4. Development controls.
To mitigate risks associated with any development partners, Avona enforces a strict Production Air Gap:
- Environment Separation: Development and Staging environments are physically isolated from the Production environment.
- Data Restrictions: All operate exclusively in the Staging environment using Synthetic Data (dummy records). They have zero access to live customer PII or banking credentials.
- Deployment Pipeline: Code is deployed to Production only after a mandatory code review and approval by the Head of Information Security.
- Endpoint Security: All developer workstations must have active antivirus, disk encryption, and automatic updates enabled.
5. Third-party management (Zoho).
Avona utilises the Zoho One suite for customer relationship management. To ensure security:
- Data Minimisation: Only necessary contact information (Name, Email) is synced to Zoho. Sensitive banking transaction data remains isolated in our AWS Production Environment and is never stored in Zoho.
- Access Control: Access to the Zoho admin panel is restricted to authorised staff via MFA.
- Residency: We have configured our Zoho instance to host data within their EU Data Centre to ensure GDPR alignment.
6. Data management.
- Classification: All financial transaction data is classified as "Confidential."
- Retention: Customer data is retained for 6 years + current year in accordance with HMRC requirements, after which it is securely purged.
- Backups: Automated daily backups are performed and stored in a geographically redundant S3 bucket. Backups are encrypted and retained for 30 days.
7. Incident response.
In the event of a suspected breach:
- Identification: Any staff member suspecting a breach must report it to the Director within 1 hour.
- Containment: The Head of Information Security will isolate affected systems (e.g., revoking keys, taking the API offline).
- Notification: Avona will notify Finexer Ltd and the ICO (if applicable) within 72 hours of becoming aware of a reportable breach.
8. Review & audit.
This policy is reviewed annually or upon significant infrastructure changes. Vulnerability scanning is conducted quarterly.