Commitment to Security & Operational Resilience

Yes. Our Information Security Management System (ISMS) aligns with the ISO/IEC 27001:2022 standard. Our policies are approved by the CEO and top management, communicated to all employees, and reviewed at least annually or upon significant operational changes.

Yes. Information security governance is driven by top management:

• CEO — ultimate accountability
• CTO — technical infrastructure and secure development
• CISO — compliance, audits, and risk management

We enforce strict segregation of duties (e.g., separating development from production operations) to prevent conflicts of interest and unauthorised access.

Yes. We maintain a formalised Risk Management Policy. Risks are assessed at least annually (or upon significant change), recorded in a Risk Register, and linked to specific mitigating controls.

Yes. Compliance is continuously monitored via internal audits, external certification audits, and regular Management Review meetings.

CTO2B provides an IaC-based cloud infrastructure management platform. Our customers' environments are hosted on top-tier public cloud providers, meaning data center locations are determined by the customer's selected region — typically within the EU/EEA to ensure data sovereignty. Detailed architecture diagrams for specific customer implementations can be provided under NDA.

CTO2B implements strict network segregation (using VPCs, subnets, and micro-segmentation) within the cloud environments we build and manage for our customers. We utilise gateways, firewalls, and filtering routers to prevent unauthorised connections.

ℹ️

Shared Responsibility: CTO2B cannot guarantee or enforce compliance for external networks or on-premise environments managed outside of the CTO2B-provisioned cloud.

Yes. All confidential data transmitted across networks (data in motion) is encrypted using TLS 1.2 or higher. Access to our internal systems and customer cloud environments requires Multi-Factor Authentication (MFA), and inactive sessions are automatically configured to terminate after 15 minutes of inactivity.

Yes. Our platform leverages Infrastructure as Code (IaC) practices. This ensures that infrastructure components are standardised, immutable, hardened by design, and strictly version-controlled.

Yes. We maintain a Secure Development Policy and a Change Management Policy. All changes to infrastructure and code are tracked through a centralised change management system and version control.

Because we utilise an IaC model, direct human access to production environments is minimised. Code changes require:

1. Peer review by someone other than the author
2. Automated security testing
3. Approval from an Engineering Lead before deployment into production

Development, testing, and production environments are strictly separated.

Yes. Vulnerabilities are identified through a combination of scheduled and event-driven scanning and reviews, then triaged by severity, exposure, exploitability, and business criticality. There is no fixed patch SLA — remediation is handled in a timely, risk-based manner, prioritising Critical and High-risk findings. See Vulnerability Management for the full scope and process.

Access is granted based on the principle of least privilege and requires line manager approval. Privileged/administrator accounts are tightly controlled, uniquely identifiable, not shared, and monitored. User access is reviewed every 90 days, and all access is revoked immediately upon an employee's termination.

Yes. Passwords must meet strict complexity requirements (minimum 12 characters, mixed case, numbers, special characters) and are rotated regularly. Passwords are securely stored using an enterprise password manager, and MFA is mandatory for accessing sensitive systems and data.

Yes:

• Data at rest: AES-256 bit encryption
• Data in transit: RSA 2048 and TLS 1.2+
• Key management: Cryptographic keys managed within secure vaults or hardware security modules (HSMs) under our Cryptographic Key Management Policy

We maintain a Physical and Environmental Security Policy and a Clear Desk and Clear Screen Policy. Office access requires electronic entry cards, and visitors are escorted at all times.

ℹ️

Since customer data is hosted in public clouds, the physical security of the data centers processing customer data is governed by the hyperscalers' own industry-leading physical security compliance programmes.

Yes. Background verification checks are conducted for new hires, proportionate to business requirements and applicable local legislation. Employees must sign confidentiality/NDAs that remain valid after employment ends.

Remote working requires the use of approved, encrypted devices, secure connections (VPN), and MFA. The BYOD policy restricts personal devices to accessing company communication tools only (via MFA) — personal devices cannot access or store sensitive company or customer data without explicit authorisation and enforced security controls.

Yes. All employees and contractors undergo mandatory security awareness and GDPR training during onboarding and at least annually thereafter. We also conduct periodic social engineering and phishing simulations.

Yes. CTO2B maintains a comprehensive Business Continuity Policy and a Disaster Recovery Plan approved by management. The plans outline response strategies for major incidents including regional cloud outages, ransomware, and infrastructure failures.

Yes. BCP and DR capabilities are tested at least annually (e.g., tabletop exercises or alternative workplace tests). Our HR practices include functional substitution and succession planning for key personnel to ensure critical knowledge is not lost during an emergency.

• Scope: production databases and mission-critical data
• Frequency: daily backups
• RTO and RPO: 1 day
• Encryption: all backups encrypted
• Redundancy: stored across multiple regions
• Retention: at least 7 days (longer depending on asset class)
• Testing: backup restorations tested periodically

We maintain a Third-Party Supplier Security Policy and a Cloud Service Policy. Suppliers are risk-assessed, required to hold appropriate certifications (e.g., ISO 27001, SOC 2), and bound by Data Processing Agreements (DPAs). We maintain substitution procedures in the event of vendor failure.

Yes. System activity, exceptions, and security events are centrally logged and monitored. We have a Major Incident Response Procedure. In the event of a breach or significant disruption, a Major Incident Management Team (MIMT) is activated.

Yes. Our Personal Data Breach Policy mandates that any confirmed or suspected breach involving customer data must be evaluated and reported to the affected customer (and the supervisory authority, where applicable) within 72 hours, or as stipulated by the specific customer contract.

No. CTO2B has not experienced any material security incidents affecting customer data in the preceding 12 months.

Yes. We maintain a Data Protection Policy, a Data Retention Policy, and an Information Classification Policy. Data is retained only as long as necessary for legal or business purposes.

Data is securely disposed of (e.g., cryptographic wiping, secure overwrite, or certified destruction) or anonymised. Destruction logs are maintained.

Yes. Data privacy oversight is managed by the CISO and legal/compliance team. Data Privacy Impact Assessments (DPIAs) are conducted to address privacy risks during significant changes or when onboarding new processing activities.

Customer data remains within the public cloud environments hosted in the regions chosen by the customer — typically within the EU/EEA — ensuring compliance with EU data residency and GDPR requirements.