Information Security Policy

1. Purpose

The purpose of this Information Security Policy is to establish a framework for protecting Velosity's information assets from all threats, whether internal or external, deliberate or accidental.

2. Scope

This policy applies to all employees, contractors, and third-party users who have access to Velosity's information systems and data.

3. Policy Statements

3.1 Confidentiality, Integrity, and Availability

• Information must be protected against unauthorized access (Confidentiality).
• Information must be protected from unauthorized modification (Integrity).
• Information must be available to authorized users when needed (Availability).

3.2 Access Control

• Access to Velosity systems is granted based on the principle of "Least Privilege."
• Multi-factor authentication (MFA) or SSH key-only authentication is required for all production systems.
• User access must be reviewed periodically and revoked immediately upon termination of employment or contract.

3.3 Data Encryption

• Data in transit must be encrypted using industry-standard protocols (e.g., TLS 1.2+).
• Sensitive data at rest must be encrypted using AES-256 or equivalent standards.

3.4 Change Management

• All changes to production environments must be documented, tested, and approved.
• Change logs and audit trails must be maintained via version control (Git) and CI/CD pipelines.

3.5 Incident Management

• All security incidents must be reported and investigated.
• Incident response plans must be regularly tested.

4. Responsibilities

• The DevOps/Security team is responsible for implementing and maintaining security controls.
• All users are responsible for complying with this policy.

5. Compliance

Failure to comply with this policy may result in disciplinary action, up to and without excluding termination of employment or contract.