Information Security Policy

Purpose and scope

Clients trust FourSight Technologies Inc. with access to their systems and data. This policy sets out the security practices that apply to our own systems, to client environments we manage, and to everyone who works for us.

Our controls

• Access control: each person has their own account, access follows the principle of least privilege, and access is removed on the same day someone leaves or changes role.
• Multi-factor authentication: required on email, administrative, remote access and client management tools.
• Encryption: data is encrypted in transit using TLS 1.2 or higher, and at rest wherever the platform supports it. Company devices use full-disk encryption.
• Email protection: our domains publish SPF, DKIM and DMARC to prevent spoofing.
• Patching and endpoint protection: operating systems and applications are kept up to date and devices run endpoint protection.
• Backups: critical data is backed up regularly, and restores are tested.
• Web protection: our websites run behind a web application firewall with bot and rate-limit protection.
• Credentials: passwords and secrets are stored in approved password managers and never shared over email or chat.

Client data

We access client systems and data only as needed to deliver agreed services, keep client information confidential, and return or securely delete it when an engagement ends. Personal information is handled under our Privacy Policy. Some of the service providers we use store data outside Canada; our Privacy Policy explains this.

People

Team members and subcontractors agree to confidentiality obligations and receive security awareness training, including phishing and social engineering, when they join and at least once a year. Where a client requires security screening or clearance, we assign only appropriately screened personnel.

Suppliers

We use established technology providers and review their security practices before entrusting them with client data.

Incident response

Suspected security incidents are reported immediately to the Lead Partner, contained, investigated and documented. We notify affected clients without undue delay. Where a breach of security safeguards involving personal information creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as required by PIPEDA.

Reporting a vulnerability

Security researchers can contact [email protected]. Our security.txt file has the details.

Related policies

See all of our policies on the Public sector page, including our Privacy Policy.