INBULK Public Information Security Policy

1. Purpose

1.1. This Policy describes the public principles of information security. It does not disclose configurations, keys, detailed controls or other information that could weaken protection.

1.2. This Policy is not a certification, a guarantee of absolute security or a service level agreement (SLA), and does not limit the Operator’s obligations expressly established by the Agreement or by applicable law.

2. Information security principles

2.1. The Operator organises the protection of the Platform, data and operations on the basis of the following principles:

• a risk-based approach and layered protection — security measures are determined taking into account the nature, likelihood and possible consequences of the relevant risks
• least necessary access — Users, employees and contractors are granted only the access rights necessary to perform their functions
• segregation of duties — critical functions and Legally Significant Actions are, where necessary, distributed between different roles or require additional confirmation
• security and data protection by default — information security and data minimisation requirements are taken into account when designing, developing and configuring the Platform
• controlled change management — development, testing, deployment and modification of functionality are carried out using appropriate control procedures
• logging and preservation of evidence — significant events and actions are recorded to the extent necessary for security, incident investigation and confirmation of the relevant operations
• incident readiness and recovery — the Operator maintains procedures for detection, response, recovery and continuity of critical functions
• third-party risk management — before critical providers are engaged, the risks associated with them in terms of security, data access and continuity are assessed
• regular review and improvement — security measures are periodically reviewed and updated in the light of changes in risks, technology, legislation and Platform functionality.

3. Access management

3.1. Access to the Platform and its features is granted in accordance with defined roles and the principle of least necessary rights. Rights to perform Legally Significant Actions are granted and controlled separately from ordinary access rights.

3.2. For administrators, and for actions with a heightened level of risk, the Operator may apply enhanced measures of authentication and confirmation of authority, in particular multi-factor authentication (MFA), repeated authentication, a qualified or other electronic signature that meets the requirements of the applicable law of the relevant jurisdiction, additional approval by another authorised person or other controls, depending on the nature and level of risk of the action concerned.

3.3. Access by employees and contractors to the Platform and its systems is granted only to the extent and for the period necessary to perform their functions. Such access is subject to periodic review and is revoked without undue delay once the need for it ends.

4. Data protection

4.1. Encryption in transit, storage controls, segmentation, backup, export restrictions and protection of secrets are applied to a proportionate extent.

4.2. Passwords are not stored in plain text. Cryptographic keys, tokens and other secret access data are stored and processed separately from program code and ordinary event logs, with appropriate access controls applied.

4.3. Electronic evidence, signed documents and event logs are protected against unauthorised modification, deletion and access. Preservation measures must make it possible to establish the integrity, time and sequence of legally significant events to the extent provided by the Agreement and the relevant policies.

5. Development security and change management

5.1. In the course of development, testing and deployment of changes, the Operator applies, in particular, the following measures:

• taking information security and personal data protection requirements into account at the design and development stages
• review of program code, testing of functionality and security control of the software components and dependencies used
• separation of development, testing and production environments
• controlled deployment of new versions and changes, with the ability to roll back to the previous stable version in the event of critical problems
• detection, assessment and timely remediation of vulnerabilities, including by installing the necessary security updates
• detection of accidental placement of passwords, keys, tokens and other secret data in program code or configurations, and restriction of access to the production environment
• additional security review of functionality relating to Legally Significant Actions, payments, electronic signature and the use of artificial intelligence.

6. Monitoring and event logging

6.1. The Operator logs the events necessary to ensure security, control access, confirm Legally Significant Actions and investigate incidents. Such events may include, in particular, logins to systems, access to data, changes to rights and configurations, and the performance of significant operations.

6.2. Event logs are protected against unauthorised access, modification or deletion, contain consistent timestamps and are retained for the periods established by the relevant data retention rules.

6.3. Monitoring is used to control the availability and stability of the Platform, and to detect fraud, anomalous or suspicious activity, abuse, attempted unauthorised access and other information security incidents.

7. Third-party provider management

7.1. Before engaging a third-party provider that has access to critical functions, systems or data of the Platform, the Operator assesses the risks associated with that provider, in particular the level of information security, the conditions of processing and the location of data storage, the use of sub-processors, continuity of service, the arrangements for terminating cooperation and the allocation of contractual liability.

7.2. A third-party provider’s access to Platform systems and data is limited to the minimum necessary extent. The arrangements for incident response, audits, return or deletion of data and termination of access are set out in the agreement with the relevant provider.

8. Business continuity and recovery

8.1. The Operator applies measures to maintain the continuity of critical Platform functions, in particular data backup, recovery procedures after failures, monitoring of service availability, communication arrangements during incidents and recovery plans for critical systems.

8.2. Recovery time objectives (RTO), recovery point objectives (RPO) and service levels (SLA) apply only where such indicators have been formally approved and are expressly provided by the terms of the relevant service.

9. Incidents

9.1. The incident response process includes detection, initial assessment and prioritisation, containment, eradication of causes and consequences, restoration of systems, preservation of the necessary evidence, informing interested parties, root cause analysis and implementation of corrective measures to prevent recurrence.

9.2. Users are notified where required by law, by contract or by the risk involved, within the limits of the reliable information available.

9.3. Public communications are coordinated so as not to impair the investigation or security.

10. User obligations

10.1. The User must:

• use unique and sufficiently strong passwords, and multi-factor authentication (MFA) where available
• not share with third parties its credentials, one-time confirmation codes (OTP), electronic signature keys or other authentication means
• promptly terminate or restrict access for employees, representatives or other authorised persons who no longer need such access, and periodically review the rights granted to them
• verify payment, banking and other material details, and the content of higher-risk actions, before confirming them
• not upload, distribute or use malicious software, and not circumvent the security mechanisms established by the Platform
• notify the Operator without undue delay of suspected phishing, compromise of an account or access means, an erroneous or unauthorised payment, suspicious activity, a discovered vulnerability or any other information security incident
• take reasonable measures to protect its own devices, networks, accounts and copies of documents used to work with the Platform.

11. Vulnerability reporting

11.1. Reports are sent to [email protected] with the subject line “Security”. You must not access other people’s data, impair availability, engage in social engineering or demand a reward as a condition of non-disclosure.

11.2. The Operator may publish separate coordinated disclosure rules defining the permitted scope of research and the arrangements for interaction. The absence of a bug bounty programme does not prevent a good-faith vulnerability report, but does not create an obligation for the Operator to pay a reward.

12. Compliance and review

12.1. Information security measures and mechanisms are reviewed periodically and, where necessary, updated in the light of the requirements of applicable law, current risks, changes in the functionality of the Platform, the results of incidents and reviews, and the development of the relevant international and industry standards.

12.2. A reference in this Policy to international, national or industry standards is used solely as a benchmark of good practice and does not mean that certification, accreditation or formal conformity with such a standard exists, unless this is expressly confirmed by the Operator.

Version history