Ensuring Client Data Security
Opaida takes protecting client data seriously. All Opaida employees, contractors, and suppliers are responsible for ensuring the security and confidentiality of client information. To meet this responsibility, we maintain a system of controls and requirements to prevent unauthorized access, modification, destruction, or disclosure of client data. This Data Protection & Handling Policy (Policy) establishes the system of controls for protecting Sensitive & Confidential Data (as defined below).
This Policy and supporting procedures are designed to provide Opaida with a documented and formalized data protection policy to comply with various regulatory and business needs.
The scope of this Policy covers all Confidential & Sensitive Data stored, accessed, or transmitted by our software platform, including its applications, components, infrastructure, and underlying code (together, our products).
Additionally, this Policy applies to all employees, contractors, and third-party suppliers of Opaida that collect, access, maintain, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle Opaida's Confidential & Sensitive Data. All employees, contractors, and, as applicable, third- party suppliers are responsible for reading this Policy and complying with its requirements.
The following roles and responsibilities regarding data protection practices are to be developed and subsequently assigned to authorized personnel within Opaida:
Opaida products for clients are deployed using one of the following models:
The following types of data are being stored, processed, and/or transmitted on system components that are owned, operated, maintained, and controlled by Opaida:
Opaida believes in proactive risk management of data protection threats. Opaida conducts a thorough, periodic information security risk assessment (Risk Assessment) of our products' networks, systems, and applications to document threats and vulnerabilities to stored and transmitted information. The Risk Assessment incorporates data protection risks, including, but not limited to:
The Risk Assessment serves as a roadmap for Opaida to implement mitigating controls to reduce the impact of identified data protection risks. The Chief Risk Officer oversees remediation plan development and tracks remediation actions to completion.
Opaida collects, processes, uses, shares, retains and disposes of Sensitive & Confidential Data only in compliance with our legal and business requirements. Opaida also works with clients to define the specific Sensitive & Confidential Data types collected by our products.
Opaida uses the following guidelines for the use and disclosure of Sensitive & Confidential Data:
Internal data use: Only use Sensitive & Confidential Data for approved business purposes consistent with the scope of services outlined in the respective client's contract.
Internal data sharing: Limit the internal sharing of Sensitive & Confidential Data to members of the workforce whose access is necessary to execute their specific roles and responsibilities (i.e., apply the principle of "Just Enough Privilege”). External data sharing: May share Sensitive & Confidential Data with third parties for approved business purposes that are consistent with the purposes for which Opaida collected the Sensitive & Confidential Data. Written agreements are maintained with such third parties that require them to maintain robust data protection and security controls to ensure an appropriate level of protection.
Cross-border data transfers: Ensure that all parties with which we engage in cross- border data sharing provide adequate data protection safeguards for Sensitive & Confidential Data transfers. The identities and respective countries of non-U.S. suppliers, or types of non-U.S. suppliers, that may access/store Sensitive & Confidential Data are disclosed to the client.
Unless otherwise required by law, Opaida retains Sensitive & Confidential Data only for as long as necessary to fulfill the purposes for which it is collected and processed, or to meet legal and client contractual obligations. To support compliance with these obligations, the CTO shall, on an annual basis, review Opaida's existing retention practices regarding Sensitive & Confidential Data.
Sensitive Data is only stored in approved systems, databases, and devices. The storage location depends on the type of deployment:
Opaida specifically prohibits employees from storing Sensitive Data in the Opaida development environment, on their Opaida-issued laptops or desktop computers, on their personal devices, on removable media (e.g., USB flash drives), or on printed media.
Once Sensitive & Confidential Data is no longer necessary or has reached the end of its retention period, it is securely disposed of. Processes are in place for the secure disposal of data when the data is no longer needed for legal, regulatory and, business requirements. An automatic or manually executed process is to be in place for identifying and securely removing data that exceeds the defined legal, regulatory, and business requirements. As for disposing of data, the following methods are to be utilized for both hard copy and electronic data:
Opaida maintains reasonable technical, organizational, and physical security measures to protect the security and confidentiality of Sensitive & Confidential Data from unauthorized access or unlawful disclosure. The security for Sensitive & Confidential Data is managed in accordance with the Opaida's Information Security Policy. Critical security controls include, but are not limited to, the following:
Sensitive & Confidential Data transfers must be sent via a secure transfer system, such as TLS or SFTP.
All Opaida servers, workstations, and laptops must use disk encryption.
Use a secure file transfer platform to transfer files outside of the Opaida network.
During transfer, verify that all files sent into the Opaida network are free of corruption and that the file originated from a known source.
Encrypt company application databases that are externally accessible via web traffic and provide a level of identification security using an application- specific protocol, such as HTTPS. Sensitive Data in Opaida databases must additionally be encrypted client-side before being inserted into the database.
Sensitive Data remains in either (i) the on-premises deployment of our products, or (ii) the secure cloud environments.
Sanitize all production data before use in non- production environments, as applicable.
Maintain a process for identifying, managing, and resolving privacy incidents, in accordance with the Opaida Incident Response Policy.
A critical component of any successful organization is the ability to properly provision, manage, monitor, and off-board all users that have been granted access rights to company-wide information a concept universally known as access rights and/or access control. The phrase "system resources" includes any type of component, application, data source, or any other type of business resource identified by a company for which users have the ability to access through a process generally known as authentication and authorization. Opaida's data access policy consists of several parts:
Opaida is required to protect the confidentiality, integrity, and availability of its information systems that contain sensitive and confidential data. All sensitive and confidential data must be protected via access controls to ensure that data is not improperly disclosed, modified, deleted, or rendered unavailable. The Systems Administrator or assigned delegate is responsible for establishing, documenting, reviewing, modifying, and terminating user access to Company information systems that contain sensitive and confidential data.
As described in section Data Access Request Process, approvals must be obtained and documented prior to granting access. Employees who have been authorized to view information at a particular classification level will only be permitted to access such information on a need to know basis. All access to systems should be configured to provide a particular user access only to what he/she needs to perform his/her business function. On an as-needed basis, employees may request additional access permissions if their work requires it. This additional access must be approved in writing by the relevant executive.
The following generally describes the workflow used within the Company for requesting new access:
Requests for change of access must be submitted by the user's manager. HR and department managers must complete an access change checklist as part of any employee transfer when a role or department change is initiated.
Direction regarding the removal of an employee's access shall follow the same workflow above except the request for removal can come from either the HR Department or the employee's manager and should be requested within a reasonably acceptable expeditious manner and in accordance with HR policies concerning user/employee off-boarding.
Opaida conducts annual Information Security Training as required per our Information Security Policy. A component of this required training includes coverage of data protection and privacy requirements related to Sensitive & Confidential Data. The data protection and privacy training components include, but are not limited to, requirements about Sensitive & Confidential Data collection, handling, use, disclosure, and safeguarding.
Opaida provides training on secure coding practices to its developers. This is facilitated by the management team. The training covers all the content included in the most recent OWASP Top Ten, providing technical concepts and recommendations to address them.
The Policy Owner owns this Policy and is responsible for reviewing the Policy for updates annually, or following any major changes to Opaida's sensitive data environment. The Policy Approver retains approving authority over this Policy.
Opaida periodically monitors adherence to this Policy to help ensure compliance with applicable laws, requirements, and contractual agreements that apply to Client & Consumer Data. Opaida may also establish enforcement mechanisms, including disciplinary actions, to help ensure compliance with this Policy.