Techly Information Security Policy

Purpose

This policy sets out how Techly Operations Pty Ltd (Techly), which operates Pyron, protects the information it holds: its customers' data first, and its own. It is the umbrella over Techly's other security and privacy policies, each of which is published in this Trust Centre.

Scope

• Pyron's production service and everything it runs on: Techly's AWS accounts, its Cloudflare account, and the service providers named in the Privacy Statement.
• The systems used to build and run Pyron: the source code and its continuous integration on GitHub, the infrastructure code that defines every cloud resource, and Techly's Google Workspace.
• Everyone who works for Techly and can reach those systems, including contractors. This policy calls them staff.

Who is responsible

Techly is a small company, and its two directors are accountable for information security.

• Aden McCusker, Technical Director, runs it day to day. He owns Pyron's architecture, its infrastructure and these policies, keeps the risk register and the control register (below), is the on-call engineer, and leads the response to an incident.
• Jagjit Saluja, Managing Director, takes part in each policy's annual review and in every decision to accept a risk.
• The Data Protection Officer, a director, owns how personal information is handled (Techly Data Protection and Privacy Policy).
• Pyron Support is Techly staff who sign in to a customer's workspace to help. They sign in through Techly's Google Workspace, which enforces 2-step verification.

One engineer builds and operates Pyron. Where a larger team would separate duties between people, Techly relies on controls that do not depend on a second person: required checks on every change, alerts on the most sensitive actions in its cloud accounts, and activity records copied into a separate archive account under a retention lock.

How security is run

• Least privilege, and no by default. People and services get the access their work needs and nothing more. Pyron's own permission engine answers no unless a role or a share says yes.
• Everything as code. Cloud resources, network rules, alerts and access assignments are defined in code and changed through pull requests (Techly Change Management Policy).
• Customer data stays where it is processed. Customer data is classified Restricted and handled as the Techly Data Classification Policy says.
• Encrypted at rest and in transit. Data is encrypted at rest with AES-256, and in transit over public networks with TLS 1.2 or later.
• Recorded. Every change in a workspace is on its audit trail, and activity in Techly's cloud accounts is recorded by AWS CloudTrail.
• Watched. Alerts page the on-call engineer, and each alert has a written runbook (Techly Incident Management Policy).
• Said truthfully. What Techly publishes about Pyron's security must be true of production on the day it is published. Automated tests on the website refuse the claims Techly has withdrawn.

Risk

Techly keeps a risk register. Each risk records what could happen, its likelihood and impact, who owns it, and how it is treated: reduced by a control, avoided, transferred, or accepted.

• Only a director may accept a risk, and an accepted risk is recorded with the reason.
• The Technical Director reviews the register every quarter, and whenever a change to Pyron, its providers or the law affects a risk.
• A gap in a control, an exception to a policy and a finding from a security scan each become a risk on the register until they are closed.

The register is internal, because it describes weaknesses in detail. What Techly does not yet have is published in the Security overview.

Controls

Techly is building one register of its security controls: each control, whether it is in place, partial or planned, and the evidence for it, mapped to the frameworks Australian buyers ask about. The framework assessments built from it are published in this Trust Centre as each is completed. Techly holds no security certification.

Policies under this one

• Techly Data Protection and Privacy Policy
• Techly Data Classification Policy
• Techly Incident Management Policy
• Techly Records Management Policy
• Techly Change Management Policy
• Techly Access Control Policy
• Techly Acceptable Use Policy
• Techly Supplier and Third-Party Security Policy
• Techly Business Continuity and Disaster Recovery Policy
• Techly Vulnerability and Patch Management Policy
• Techly Secure Development Policy
• Techly Logging and Monitoring Policy
• Techly Cryptography Policy

How Pyron's AI handles customer data is set out in the Pyron AI and Automated Processing Statement.

Staff

• Staff read these policies when they join and confirm each year that they still follow them, including the Techly Acceptable Use Policy.
• Staff report anything that might be a security incident to the Technical Director straight away, including a lost device or a message that might be phishing.
• Access is removed on the day someone leaves.
• Breaching these policies can lead to access being removed.

Review

The directors review this policy every year, and sooner after a serious incident or a significant change to Pyron. Each review is recorded with a new version and effective date.