Security and privacy operating policies

Version 1.0, approved and effective 9 October 2026. Accountable owner for every policy: Julien de Bats, founder/CEO of Digital Envision LLC, the operator of DMC Pilot. These policies cover everyone with access to company systems, including contractors. Julien approved this policy set on 9 October 2026. These policies govern our security and privacy operations. The Security and trust page describes our safeguards and published documentation.

Governance and responsibilities

Julien owns information security, privacy operations, incident coordination, supplier reviews, access approval, assets, recovery and risk treatment. He approves material changes, resources, exceptions and policy revisions. Review these policies annually and after a material incident or service change. Keep dated approval, distribution and exception records. Exceptions require scope, reason, compensating safeguards, an expiry date and Julien’s decision; they never override contractual or legal obligations.

This is an operational privacy appointment. A statutory DPO appointment and EU/UK representative appointments require separate eligibility and independence checks; no such appointment is implied here.

Information classification and handling

Public information may be published after review. Internal information includes plans and operating procedures. Confidential information includes customer records, staff details and supplier contracts. Restricted information includes health data, credentials, private keys, identity evidence and incident material. Confidential and restricted data require authenticated, limited access, encryption in transit and at rest, and the minimum useful retention. Keep these records out of public tickets, source repositories, unapproved AI tools and ordinary personal cloud folders.

Access health data only for an identified service purpose. Follow the product’s lawful-basis gate, access logging and fixed retention ceiling. Use synthetic or anonymized test data. Send customer information through approved systems with scoped access and expiring links. Review the recipient and scope before sending an export. Securely erase temporary copies when the task ends.

Access, authentication and personnel

Approve named access before it is granted; record the system, role, purpose and approver. Use individual accounts, least privilege and MFA for company administration. Store unique credentials in an approved password manager and service secrets in managed secret stores. Never share passwords or place credentials in code, logs or chat. Keep emergency access separate and record each use.

Review privileged access monthly and all company access quarterly. Revoke access immediately when a person leaves or no longer needs it; transfer owned work, revoke active sessions and tokens, and record completion. Before granting access, require confidentiality obligations, acceptable-use acknowledgement and security/privacy induction. Screening must be proportionate and lawful. Suspected misuse follows documented fact-finding and contractual or employment procedures.

Company devices and remote work

Inventory every computer, phone and removable device that accesses company systems. Record its owner, platform, support status, encryption, firewall, malware protection, update state and last check. A known local workstation is inventoried internally; completeness of the company estate is still being verified.

Require a supported operating system, full-disk encryption, enabled host firewall, active supported malware protection, automatic security updates and a screen lock after no more than five idle minutes. Use a standard account for daily work and a separate administrator account for elevation. Apply critical or high-risk security fixes within 14 days, sooner if actively exploited; isolate unsupported or compromised devices. Verify settings rather than assuming a vendor manages endpoints.

Keep devices physically secure, use trusted networks or a suitable encrypted tunnel, avoid shared computers for restricted data and report loss immediately. Erase company data before disposal or reassignment and retain a disposal record. Staff must not install unapproved remote access tools or disable security safeguards.

Secure development and change control

Version-control application, infrastructure and configuration changes. Record the reason, scope, security/privacy effect, verification, deployment and rollback plan. Review changes before production release. When staffing prevents independent review, Julien records that limitation and arranges a second review for changes affecting authorization, secrets, payments or personal data.

Separate production from development and testing. Do not use live personal data in ordinary test fixtures. Test tenancy boundaries, permissions, sensitive-data handling and failure paths appropriate to the change. Protect deployment credentials and restrict production access. Emergency changes require a recorded incident or urgency reason, bounded verification, rollback readiness and retrospective review within two working days.

Vulnerabilities and configuration

Track dependency and platform advisories, vulnerability reports and configuration drift. Triage a suspected critical exposure within one working day. Contain confirmed active exploitation immediately; target critical remediation within 72 hours, high-risk remediation within 14 days, medium within 30 days and low within 90 days. These are internal treatment targets, not customer response guarantees. Document missed targets and compensating safeguards.

Disable unnecessary services and default accounts; use restrictive network and cloud permissions. Review security-sensitive configuration quarterly and after a material change. Commission an independent penetration test at least annually and after a major security-relevant change as part of the testing program. Track retesting and closure evidence. Follow the vulnerability disclosure policy.

Logging, monitoring and incidents

Record administrative access, relevant changes, access to health data and security events. Limit log access and redact credentials, personal payloads and health values. Preserve timestamps and evidence integrity. Review security alerts each working day and investigate backup failures immediately when observed. Check that alert delivery actually reaches Julien; do not claim staffed 24-hour monitoring.

Report suspected compromise immediately to security@dmcpilot.com. Julien coordinates containment, evidence preservation, impact assessment, customer communication and recovery. The existing incident procedure commits to notifying affected customers within 48 hours of awareness of a personal data breach, with updates as facts develop. Record decisions and awareness times. Test the procedure annually and after material changes; retain a lessons-learned record after incidents. Statutory authority/individual notices are assessed separately according to role and applicable law.

Backup, recovery and continuity

Managed daily database snapshots are supplemented by automated independent, age-encrypted database archives in a separate Cloudflare R2 backup bucket. Daily integrity checks download a stored archive and compare its hash. The private decryption key must remain offline, separately protected, with controlled recovery access. Successful integrity checks do not establish decryption or restoration.

Julien must verify the backup bucket’s lock and lifecycle configuration, recovery-key custody and access separation. Conduct an offline recovery drill quarterly and after material backup changes, in a disposable environment, with outbound email, webhooks and scheduled business actions disabled. Verify authorization, data integrity and application behavior before any cutover. Recover file bytes and service configuration separately: a database archive alone cannot provide them. Document measured recovery time and data loss. Customer service commitments are set out in the Terms.

Suppliers, cloud services and AI

Before a supplier receives confidential data, record the purpose, data categories, processing locations, access, security evidence, retention, contract and transfer mechanism. Review critical suppliers annually and after material changes. Keep the subprocessor register, agreements and exit plans current. Follow DPA notice and objection terms before subprocessor changes.

Use approved AI routes only. Minimize prompts, preserve permission checks, and enforce the product’s no-training and health-data endpoint restrictions. Review output before decisions or external communication. New AI processing requires a privacy/security review and an assessment of applicable automated-decision requirements. Never bypass safeguards with a personal model account.

Records, software ownership and service resources

Keep licenses, software ownership, confidentiality obligations and permitted third-party use documented. Restrict source access and do not copy unlicensed content into the product or publish confidential work. Version approved operating documents and preserve the evidence needed to investigate incidents and verify obligations. Store assurance records in restricted locations with a documented retention decision.

Review service capacity, provider quotas and seasonal demand before major programs or changes. Record material limits and continuity dependencies. Use trustworthy platform time sources and UTC timestamps for operational evidence. Protect production during audits and testing through agreed scope, isolated environments and restricted data access. Use supported browser/download protections and train personnel to identify phishing; record actual endpoint safeguards rather than assuming they exist.

Retention and disposal

Follow the published retention schedule and each customer’s lawful instructions. Health, dietary and accessibility details have a mandatory 30-day ceiling after a program ends. Optional retention classes require the customer to enable enforcement. Obtain and record customer instructions, review the affected-data report and offer an export before enabling irreversible deletion. Do not turn on deletion across customers merely to satisfy an audit checklist.

Use backups for recovery only. After restoring, reapply erasures and retention obligations before reopening access. Verify disposal across live records, derived data, files and supplier-held copies as applicable. Retain only minimal evidence of completion, including lawful holds and exceptions. The actual verified backup-expiry settings govern how long deleted records can persist in a backup; no unverified immutability period is promised here.

Privacy requests and authorized agents

Send requests to privacy@dmcpilot.com. Julien owns intake and completion. Log the request, role, scope and deadline before verification. If we hold the data for a customer, route the request to that customer’s controller and assist under its documented instructions. Requests concerning our own account or website processing are handled by us as controller.

For an agent’s access, correction or deletion request, obtain signed permission and proportionate identity verification or direct confirmation through an existing trusted consumer channel. Do not make the consumer resubmit the request. A valid qualifying power of attorney follows its separate route; do not demand one as the only way to use an agent. Collect only necessary verification evidence, restrict it and delete it after its verification purpose ends, subject to a justified legal hold.

Use the authenticated account where possible; never request a password, MFA code or health information as identity proof. A suspicious sender address alone is insufficient authority. Do not confirm whether a person is in a tenant before authority is established. Apply documented legal exceptions narrowly, explain partial refusals, and provide the applicable escalation or complaint route. Do not discriminate against anyone for exercising privacy rights.

Our operating target is acknowledgement within two working days. CCPA acknowledgement is due within 10 business days and response within 45 calendar days, with a permitted extension notified and explained before the original deadline. GDPR responses are due within one month, with any permitted extension explained within that month. Maintain a protected request/response record for at least 24 months for CCPA requests. Log uncertainty or missing records explicitly rather than reporting zero requests without reconciliation.

Training and assurance

Train everyone with company-system access before access is granted and annually thereafter, and update training after significant changes. Request handlers also receive privacy-request and agent-verification training. Retain real attendance, assessment, acknowledgement and remedial-training records. Training material exists; no completed attendance is asserted here.

Maintain the ISMS scope, risk assessment, treatment plan, control applicability and evidence calendar. Review risks quarterly and after incidents or material changes. Julien conducts quarterly management reviews of objectives, findings, incidents, supplier changes, resources and overdue actions. Internal audit must be objective and independent of the controls being audited; a CEO self-review or an agent’s document-writing review does not replace it. Preserve findings, corrective actions, verification and management decisions.