Information Security Overview

DRAFT — This document reserves space for a verified account of Ivy’s information security practices. Its scope covers the people, systems and procedures involved in operating the service. Each topic below requires evidence from the relevant owner before publication; no certification, audit result, specific control or contractual commitment is asserted by this draft.

The security review covers the following subjects:

1. 1.Staff guidance and training. The review should document how people working on Ivy learn the responsibilities associated with handling account information and operating the service, including:

   • The guidance available to staff on handling information and following the procedures relevant to their work;
   • How changes to that guidance are communicated, who maintains it and which records demonstrate that the relevant people have received it.

2. 2.Account access. The verified description should address permissions and account management:

   • How people are authorised to use information systems and how those permissions relate to the responsibilities of their role;
   • The process for identifying and addressing access that is no longer appropriate for a person or account; and
   • How changes in responsibilities, team membership or employment affect the permissions already granted.

3. 3.Hosting and physical safeguards. The final overview should identify the hosting arrangements relevant to Ivy and distinguish controls operated by a provider from controls operated by the team. The review should cover the facilities and equipment involved, the scope of provider documentation, and how the applicable safeguards are evaluated. No particular provider, data centre arrangement or environmental control is confirmed by this placeholder. The team should retain the supporting documents and record any limits in their coverage. Topics for review include:

   • The provider’s description of physical access management and records of access to the facilities involved;
   • The available information about monitoring at facility entry points, together with the scope and retention of any relevant records;
   • The provider’s documented approach to equipment operating conditions and how those conditions are monitored or maintained; and
   • The arrangements described for continuity of power and other facility dependencies, including any limits on their scope or availability.

4. 4.Handling security events. The review should document the process for assessing and responding to a suspected security event. The final description must identify the relevant owner and cover:

   • Responsibilities: who receives a report, who coordinates the investigation and who makes the necessary decisions;
   • Assessment: how the team establishes the scope of an event and identifies the information or people affected;
   • Communication: the internal reporting process and the approach to evaluating any external notification requirements relating to the people whose information may be affected;
   • Records: how the actions taken during an investigation are documented and made available to the people responsible; and
   • Follow-up: how findings are reviewed, corrective work is assigned and the outcome of that work is recorded.

5. 5.Continuity and recovery. The final overview should describe the preparations relevant to an interruption of the service, including dependencies on providers and the distinction between a temporary outage and loss of information. The review should confirm the scope, owner and evidence for the following topics:

   • Backup arrangements: identify the information covered, the process used and the applicable retention schedule. The details remain to be verified;
   • Recovery planning: describe the documented process for restoring systems and information after an interruption.

   The review should identify how recovery procedures are checked and how the results of those checks are recorded.

   Any summary made available to customers should state the scope and date of the work and distinguish completed checks from planned improvements.

   • Business continuity: explain how the team assigns responsibility, communicates during an interruption and prioritises restoration of the affected activities.

6. 6.Activity records. Confirm which systems produce operational records, what those records contain and how they support review of relevant activity. Access, retention and the responsibilities for reviewing them require evidence.

7. 7.Accuracy and integrity. Document the implemented measures relevant to unintended changes, loss or misuse of account information. The review should explain the scope of those measures and identify their owner.

8. 8.Information in storage and transit. The final overview should describe verified protection of information when it moves between systems and while it is stored. Applicable protocols, key management arrangements, device requirements and any exceptions must be confirmed before a specific standard or level of protection is stated.

9. 9.Deletion and disposal. Describe the process for removing information and disposing of equipment or storage media. Distinguish active records, backup copies and information retained for another requirement.

10. 10.Security responsibilities. Identify how responsibility for maintaining the reviewed practices is assigned within Ivy, including the people responsible for:

    • Coordinating the security review and maintaining the approved description of the practices in scope;
    • Keeping the relevant procedures current and communicating changes to the people who rely on them; and
    • Reviewing unresolved issues and tracking agreed improvements through to completion.

11. 11.Verification activities. Describe the checks used to evaluate the practices in scope. Any statement about an assessment or independent review must identify what was examined and the evidence supporting the result. The description should distinguish work completed from work planned, including:

    • Internal review activities, their scope and the records available for the completed work;
    • Any independent assessment that has been confirmed, including its date and relevant limitations.

12. 12.Operational monitoring. Identify how relevant system events, service errors and unusual activity are monitored. The verified description should explain:

    • Which signals are reviewed, who receives them and how they are assessed;
    • How an issue is assigned to an owner and linked to an investigation or corrective action; and
    • How changes to monitoring arrangements are reviewed and documented.

13. 13.Connected services. The review should confirm the permissions used by each integration, including connected Klaviyo accounts, and the process for changing or revoking those permissions. The final overview must reflect the access actually implemented in the product.

    • Identify the information and operations available through each connection and the reason for that access;
    • Describe how account holders can review a connection and what happens when they remove it.

14. 14.Reporting a concern. The security contact and reporting process are awaiting confirmation. The approved version will explain how to report a concern and what information helps the team assess it. This draft does not promise a response time or provide an unverified contact address.