Information Security Policy

This policy describes the organisational and technical measures used to protect customer and business information, including data received through regulated Open Banking providers.

1. Purpose and scope

This policy establishes the information security principles and controls used by Balad Ltd in operating olowo. It applies to employees, developers, contractors, systems, applications and infrastructure that may process or provide access to customer or business information.

The objectives are to protect the confidentiality, integrity and availability of information and to reduce the risk of loss, unauthorised access, disclosure, alteration, destruction, misuse and cyberattack.

2. Governance and responsibility

The Director has overall responsibility for Information Security, including approval and periodic review of this policy, oversight of security risks, access controls, incident management and data-protection requirements.

The Lead Developer is responsible for day-to-day technical security, including implementation and maintenance of security controls, secure system configuration, management of authorised technical access, security logging and monitoring, software updates, vulnerability remediation and secure development practices.

Security incidents, suspected breaches and significant vulnerabilities must be escalated promptly to the Director.

3. Access control

Access to customer data and production systems will be limited to authorised personnel on a least-privilege and need-to-know basis. Customer data will not be accessed routinely by staff or developers. Access will only take place where necessary for legitimate operational or security purposes, for example investigating an error, resolving a technical issue, or investigating a suspected security incident or data breach.

Strong passwords will be required and multi-factor authentication will be used where available. Privileged and administrative access will be restricted. Access rights will be reviewed periodically and removed promptly when an individual no longer requires access or leaves the organisation.

Access credentials must not be shared between users.

4. Data protection and encryption

Customer and business data will be minimised so that only information necessary for providing and supporting the service is processed or retained.

Data transmitted between systems will be protected using secure HTTPS/TLS connections. Stored information will be protected using appropriate security controls, including encryption or equivalent safeguards where appropriate to the system and risk.

Sensitive credentials, tokens, secrets and keys must not be stored in source code or disclosed to unauthorised persons. They will be managed using appropriate secure mechanisms.

5. Secure development and OWASP

Olowo will follow secure software development practices informed by recognised industry guidance, including the Open Worldwide Application Security Project (OWASP).

Development and review activities will take account of the OWASP Top 10 and relevant secure-development guidance, with controls designed to address risks including broken access control, injection, authentication failures, cryptographic failures, security misconfiguration, vulnerable or outdated components, and inadequate security logging and monitoring.

Security considerations will be incorporated into development, testing and deployment. Changes affecting security-sensitive functionality will be reviewed and tested before release where appropriate.

6. Infrastructure and system security

Systems will be hosted and configured using appropriate security controls. These will include access restrictions, network and application security controls, secure configuration, logging and monitoring, and protection against unauthorised external access.

Operating systems, application frameworks, libraries and other dependencies will be maintained and updated as appropriate. Unnecessary services and access will be restricted or disabled where practicable.

7. Vulnerability and patch management

Identified vulnerabilities will be assessed according to their potential impact and addressed within an appropriate timeframe. Critical or high-risk vulnerabilities affecting customer data or production services will receive priority.

Software, dependencies and infrastructure will be kept reasonably current. Security patches and updates will be applied following appropriate assessment and testing.

Security issues identified by developers, suppliers, security testing or monitoring must be reported to the Lead Developer and escalated to the Director where material.

8. Logging and monitoring

Appropriate system and security logs will be maintained to support detection and investigation of unusual, unauthorised or suspicious activity.

Logging will be designed to provide useful security information while avoiding unnecessary recording of sensitive customer data. Access to logs will be restricted to authorised personnel.

Significant security alerts or unusual activity will be investigated and, where necessary, escalated as a security incident.

9. Backup, recovery and availability

Appropriate backup and recovery arrangements will be maintained for systems and information necessary to operate the service. Backups will be protected against unauthorised access.

Recovery arrangements will be reviewed and tested periodically where appropriate. The organisation will maintain reasonable measures to restore services and information following system failure, accidental loss or a security incident.

10. Security incident and personal data breach management

Suspected information security incidents must be reported promptly to the Director and Lead Developer. Incidents will be recorded, investigated, contained and remediated according to their nature and severity.

Where an incident affects Finexer data or services, Finexer will be notified in accordance with applicable contractual and regulatory requirements. Personal data breaches will be assessed and reported to the relevant supervisory authority and affected individuals where required by applicable data-protection law.

Following a significant incident, the organisation will review the cause and implement reasonable corrective measures to reduce the risk of recurrence.

11. Staff, developer and contractor security

Personnel with access to systems or customer information will be subject to appropriate confidentiality and information-security requirements.

Access will be granted according to role and business need. Personnel must protect authentication credentials, follow security procedures, report suspected incidents promptly and avoid transferring customer data to unauthorised systems, devices or third parties.

Access will be amended or withdrawn promptly when responsibilities change or access is no longer required.

12. Security awareness and training

The Director is responsible for ensuring appropriate information-security training is provided, with the Lead Developer responsible for technical and application-security guidance.

Security awareness training will be provided at induction and at least annually thereafter, with additional briefings where there are significant changes to systems, security requirements or identified risks.

Before the service goes live, relevant members of the development team will undertake formal application-security training delivered by a suitably qualified trainer covering OWASP guidance and secure development practices, including the OWASP Top 10.

Training will cover, as relevant, data protection, secure handling of customer information, access control, password and MFA security, phishing and social engineering, incident and data-breach reporting, and secure software development. Records of completed security training will be maintained.

13. Third-party and supplier security

Third-party service providers that process or provide access to customer information will be selected with appropriate consideration of security, data protection and regulatory requirements.

Access by third parties will be limited to what is necessary for the relevant service. Where appropriate, contractual arrangements will address confidentiality, data protection and security responsibilities.

Customer information will not be shared with third parties except where necessary to provide the service, where instructed or authorised by the customer, or where required by law or applicable regulatory obligations.

14. Data retention and disposal

Customer information will not be retained longer than necessary for the purpose for which it is processed, subject to applicable legal, regulatory and contractual requirements.

Where information is no longer required, it will be securely deleted after 14 days or otherwise rendered inaccessible using methods appropriate to the relevant system and data.

15. Physical and endpoint security

Devices used to access development, administrative or production systems must be appropriately protected. Reasonable controls will include device authentication, screen locking, supported software, security updates and protection against malware where appropriate.

Personnel must take reasonable precautions against loss, theft or unauthorised viewing of devices and information.

16. Review and continuous improvement

Information-security arrangements, access permissions and this policy will be reviewed at least annually and following significant changes to the service, material security incidents or significant changes in applicable requirements.

Security controls will be updated where necessary in response to identified risks, vulnerabilities, incidents, changes in technology and relevant industry guidance.

17. Policy compliance

All personnel within the scope of this policy are expected to comply with its requirements. Suspected or actual breaches of this policy must be reported promptly to the Director or Lead Developer.

Failure to follow security requirements may result in access being suspended or withdrawn and may lead to further action where appropriate.