Controls
The security controls we run across LIMINI, grouped by area.
Infrastructure security
5 controlsHow we secure the systems that host LIMINI.
Encryption at rest
Client data is encrypted at rest using AES-256.
Encryption in transit
All traffic to and from LIMINI is encrypted with TLS 1.2 or higher.
Restricted production access
Access to production systems is limited to named engineers and protected by multi-factor authentication.
Logging and monitoring
Infrastructure activity is logged and monitored, and alerts go to the engineering team.
Backups
Production data is backed up daily and restores are tested.
Organisational security
4 controlsHow we manage our people, devices and suppliers.
Security awareness training
Everyone at LIMINI completes security awareness training when they join and every year after.
Confidentiality agreements
Employees and contractors sign confidentiality agreements before they are given access to client data.
Managed devices
Company laptops are encrypted, kept up to date and managed centrally.
Supplier review
We assess the security of suppliers before they handle client data, and review them every year.
Product security
5 controlsHow LIMINI protects client data inside the product.
Client data in the client's own Vault
Each client's data is held in their own Vault, separate from other clients.
No model training on client data
Client data is never used to train models.
Role-based access
Clients control who in their organisation can see and change content in LIMINI.
Penetration testing
An independent firm tests LIMINI for vulnerabilities every year.
Vulnerability management
Dependencies are scanned for known vulnerabilities and patched on a set timetable.
Internal security procedures
5 controlsHow we plan for, detect and respond to security events.
Incident response plan
A documented plan sets out how we contain, investigate and report security incidents, and we test it every year.
Business continuity
Business continuity and disaster recovery plans are documented and tested.
Change management
Code changes are peer reviewed and tested before they reach production.
Access reviews
Access to systems holding client data is reviewed every quarter.
Risk assessment
We assess information security risks every year and track how each one is treated.
Data and privacy
3 controlsHow we handle, keep and delete data.
Data processing agreements
We sign a data processing agreement with every client, and with every subprocessor that handles personal data.
Retention and deletion
Client data is deleted at the end of a contract, on the timetable agreed with the client.
Data subject requests
We have a documented process for responding to data subject requests.