security policy

1. Introduction

Agilix Collective is committed to protecting the confidentiality, integrity, and availability of information we hold. This Security Policy explains the technical and organizational measures we apply across our company, platforms, products, services, and websites (collectively, the “Services”).

This Policy works together with our Privacy Policy and Terms and Conditions. It is a company-wide statement of practice. It does not describe the internals of any single product.

By accessing or using our Services, you acknowledge the practices described in this Policy.

2. Purpose and Scope

The purpose of this Policy is to:

• Set a consistent security baseline for people, processes, and systems
• Protect personal data, customer information, and company information
• Reduce the risk of unauthorized access, disclosure, alteration, or loss
• Support compliance with applicable data-protection and information-security obligations

This Policy applies to:

• Employees, contractors, and other personnel who handle company or customer information
• Systems we operate or control, including production, staging, and administrative environments
• Information we process as a service provider, including data stored, transmitted, or backed up on our behalf

3. International Standards We Align With

Our security program is designed to follow widely recognized international frameworks. Alignment means we use these standards as guidance for controls and process. It does not, by itself, constitute a formal certification.

• ISO/IEC 27001 and ISO/IEC 27002 — information security management, access control, cryptography, operations security, and supplier relationships
• NIST Cybersecurity Framework — identify, protect, detect, respond, and recover
• NIST guidance on cryptography — approved algorithms, key management, and protection of data in transit and at rest
• GDPR Article 32 (where applicable) — appropriate technical and organizational measures, including encryption and access control, taking into account the state of the art, costs, nature of processing, and risk
• OWASP — secure software development and common web-application risks

We review this Policy as standards, threats, and our operating environment evolve.

4. Security Principles

• Defense in depth — Multiple independent controls so that a single failure does not result in a full compromise
• Least privilege — People and systems receive only the access required to perform their role
• Need to know — Sensitive information is available only to those with a legitimate business purpose
• Secure by default — Production systems require authentication; unused services and weak protocols are disabled where we control the stack
• Separation of duties — Critical administrative functions are limited and reviewed
• Accountability — Access to production systems and sensitive data is attributable to authorized users

5. Encryption

Encryption is used as a primary control to protect information in transit and at rest, consistent with current industry practice (for example, TLS for network traffic and strong symmetric encryption for stored data).

5.1 Encryption in Transit

• Public websites and application endpoints are served over HTTPS
• TLS is used to protect data exchanged between clients and our Services
• Credentials, session tokens, and form submissions are transmitted only over encrypted connections
• We aim to keep TLS configurations current and to disable known-weak protocols where we control the stack

5.2 Encryption at Rest

• Customer and operational data stored in our cloud infrastructure is encrypted at rest using provider-supported encryption where available
• Databases, object storage, and backups are included in at-rest protection where the hosting platform provides it
• Sensitive secrets (for example, integration credentials and service keys) are stored using strong encryption, not plain text

5.3 Passwords and Credentials

• User passwords are stored using one-way hashing with a modern, salted algorithm. They are not stored in recoverable form
• Even if database contents are obtained, stored passwords cannot be reversed into usable plaintext
• We do not store payment card numbers on our systems. Any payments, if applicable, are handled through designated providers

5.4 Cryptographic Key Management

• Encryption keys and secrets are restricted to authorized systems and personnel
• Secrets are managed through environment configuration or dedicated secret stores, not committed to source control
• Keys and credentials are rotated when compromise is suspected or when operational practice requires it

6. Access Control and Authentication

Access to production systems and information is granted on a need-to-know basis and reviewed as roles change.

• Unique user accounts; shared production logins are not permitted
• Role-based access for internal tools, infrastructure, and administrative functions
• Authentication is required for protected APIs and administrative interfaces
• Sessions and tokens are invalidated on logout; expired or unused access is revoked
• Privileged access is limited, logged, and granted only for as long as needed

Users of the Services are responsible for protecting their own account credentials and for notifying us of suspected unauthorized use.

7. Application and Infrastructure Security

We design, build, and operate systems with security as a standing requirement.

• Secure coding practices and review of changes that affect authentication, data handling, or integrations
• Input validation and output handling to reduce injection and related abuse
• Use of maintained frameworks, libraries, and cloud platforms rather than ad-hoc infrastructure where possible
• Regular dependency and platform updates as part of ongoing operations
• Network access to production resources is limited; administrative access is authenticated
• Least-privilege access for services that connect to databases, storage, and third-party APIs

The Services run on cloud infrastructure that may be located in multiple jurisdictions, including the United States. We rely on the physical and environmental controls of our cloud providers, together with our own configuration of those services.

8. Data Handling and Isolation

Information is handled according to its sensitivity and the purpose for which it was collected.

• Customer information is processed only as needed to provide, operate, and support the Services
• Logical separation is used so that one customer’s data is not mixed with, or made available to, another customer through normal operation of the Services
• Access to customer data by personnel is limited to support, operations, and other authorized purposes
• Data retention follows the periods described in our Privacy Policy; residual copies in backups may remain until the backup cycle expires

9. Logging, Monitoring, and Backup

9.1 Monitoring

• System logs and usage records are used to support operations, detect abuse, and investigate incidents
• Logs that contain personal data are protected and retained only as long as needed for those purposes

9.2 Backups and Recovery

• Periodic backups support recovery and service continuity
• Backup data is treated as confidential and is subject to the same access restrictions as production data
• Backups are retained for a limited duration
• Restoration is used for continuity and recovery, not as a substitute for a valid deletion request

10. Third-Party Processors and Suppliers

We do not sell personal data.

We use cloud hosting, infrastructure, and other vendors that are necessary to run the Services. Those parties may process data on our behalf.

• Partners are expected to process data responsibly and in line with applicable law
• Integrations you connect yourself are governed by those third parties’ own security and privacy terms
• Supplier access is limited to what is required to provide the contracted service

11. Incident Response

If we become aware of a security incident that affects the confidentiality, integrity, or availability of information we hold:

• We investigate and take corrective action
• We notify affected users and, where required, supervisory authorities, in accordance with applicable law
• We take steps to contain the issue, mitigate risk, and restore system integrity

12. Personnel and Organizational Measures

• Access is granted according to role and withdrawn when employment or engagement ends
• Personnel who handle sensitive systems are expected to follow this Policy and related internal procedures
• Production system access is limited to authorized administrators

13. Your Responsibilities

Security is shared. You agree to:

• Use strong, unique passwords and keep login details confidential
• Limit account access to authorized people in your organization
• Configure integrations and exports with care
• Tell us promptly at support@agilixcollective.com if you suspect unauthorized access or a vulnerability

14. Limitations

No internet-based service can be guaranteed completely secure. The Services are provided on an “as is” and “as available” basis, as described in our Terms. We work to reduce risk in line with international good practice, but we cannot promise uninterrupted operation, absolute security, or immunity from every attack or third-party failure.

15. Changes to This Policy

We may update this Security Policy from time to time. Updates will be reflected with a revised “Effective Date.”

Continued use of our Services after changes indicates acceptance of the updated Policy.

16. Contact Information

For security-related inquiries:

Agilix Collective

Email: support@agilixcollective.com

Location: Pakistan