Compliance & Security

Overview

Compliance is an important consideration in the development and operation of digital technology services.

Reedroux recognizes the need to evaluate applicable laws, contractual obligations, industry expectations and operational risks when designing and providing its services.

Compliance requirements may vary depending on the service, the location of users, the categories of data involved and the responsibilities of the parties.

This page provides general information about relevant compliance topics. It does not replace a specific contract, regulatory disclosure or independent certification report.

Corporate Governance

Corporate governance concerns the responsibilities, decisions and oversight involved in operating an organization.

Reedroux recognizes the importance of accountability in business operations, including the management of technology-related risks and legal responsibilities.

Relevant governance considerations include:

• Identifying applicable legal and contractual obligations.
• Defining responsibility for operational and security decisions.
• Evaluating risks associated with technology systems and services.
• Maintaining appropriate records of important business decisions.
• Reviewing relevant policies as business operations evolve.

Specific governance arrangements may depend on the organization, service and applicable legal framework.

Data Protection & Privacy

Protecting personal information is an important part of responsible digital service operations.

Reedroux recognizes that personal data processing must be assessed against applicable privacy and data protection requirements, including the General Data Protection Regulation (GDPR) where it applies.

Data Processing Principles

Relevant data protection principles include:

• Processing personal information for specified and lawful purposes.
• Limiting collection to information necessary for relevant purposes.
• Maintaining appropriate accuracy and retention practices.
• Applying security measures appropriate to processing risks.
• Respecting applicable individual privacy rights.

Controller and Processor Roles

Depending on the service and processing activity, Reedroux may act as a data controller or as a data processor on behalf of a business customer.

These roles determine the responsibilities of each party under applicable data protection law.

Further information is available in our Privacy Policy.

Information Security

Information security involves protecting the confidentiality, integrity and availability of information and technology systems.

Reedroux recognizes the importance of evaluating security risks associated with software, infrastructure, user accounts and service operations.

Security Considerations

Depending on the service and infrastructure involved, relevant security measures may include:

• Authentication and access controls.
• Encrypted communications.
• Software updates and vulnerability remediation.
• Logging and technical monitoring.
• Backup and recovery procedures.
• Security incident investigation.
• Restriction of unnecessary administrative access.

The implementation of individual measures depends on the technical architecture and risks of the relevant service.

No information system can be guaranteed to be completely free from vulnerabilities or operational risks.

Infrastructure & Operations

Reliable infrastructure is an important component of digital service delivery.

Reedroux recognizes the need to consider infrastructure availability, system maintenance, configuration management and operational continuity.

Operational Responsibilities

• Evaluating infrastructure and service dependencies.
• Maintaining appropriate system configurations.
• Reviewing security updates and software maintenance needs.
• Considering backup and recovery requirements.
• Identifying operational risks and potential service interruptions.

Availability commitments, service levels and customer remedies, where applicable, are determined by the relevant service agreement.

Access Management

Access management helps limit the risk of unauthorized use of applications, systems and information.

Relevant considerations include user authentication, administrative privileges, account lifecycle management and the principle of least privilege.

Depending on system requirements, access management practices may involve:

• Assigning access based on operational responsibilities.
• Limiting privileged access to authorized personnel.
• Reviewing permissions when responsibilities change.
• Revoking access that is no longer required.
• Protecting authentication credentials against misuse.

Monitoring & Incident Response

Technical incidents may affect the security, functionality or availability of digital services.

Incident response involves identifying potential issues, evaluating their impact, taking appropriate corrective action and documenting relevant findings.

Incident Management

Depending on the nature of an incident, appropriate response activities may include:

• Reviewing system alerts and operational logs.
• Assessing the scope and severity of an incident.
• Investigating potential security implications.
• Restoring affected systems where reasonably possible.
• Communicating relevant information to affected parties when appropriate.
• Evaluating whether legal notification obligations apply.

Not every technical incident constitutes a personal data breach. Where personal data is affected, applicable notification requirements must be assessed separately.

Third-Party Services

Digital services may rely on external infrastructure, software libraries, service providers and technology integrations.

Reedroux recognizes that third-party dependencies can introduce operational, contractual, privacy and security considerations.

Relevant supplier-management activities may include:

• Reviewing the purpose of external services.
• Considering the categories of information shared.
• Assessing relevant contractual protections.
• Identifying service availability dependencies.
• Evaluating data protection obligations where personal information is processed.

Specific third-party arrangements depend on the relevant product and service environment.

Data Retention & Deletion

Retention requirements depend on the purpose of processing, applicable legal obligations and contractual commitments.

Reedroux recognizes the importance of avoiding unnecessary retention of personal information.

Relevant retention considerations include:

• The purpose for which information was collected.
• Operational and security requirements.
• Applicable statutory recordkeeping periods.
• Customer contractual obligations.
• Backup and recovery system limitations.

Information that is no longer required should be handled in accordance with applicable deletion, anonymization or retention requirements.

Security Reporting

We encourage responsible communication regarding potential security concerns affecting Reedroux services.

If you believe you have identified a vulnerability, security weakness or unauthorized exposure, please contact our team.

Reporting Guidelines

• Provide a clear description of the suspected issue.
• Include affected services or URLs where relevant.
• Explain the potential impact and steps needed to reproduce the issue, without exposing sensitive information.
• Avoid accessing, modifying or deleting information belonging to other users.
• Do not disrupt service availability or conduct destructive testing.

Security concerns can be submitted to [email protected] .

This reporting guidance does not grant permission to conduct unauthorized security testing and does not constitute a bug bounty or legal safe-harbor program.

Standards & Certifications

International frameworks and industry standards can provide useful guidance for evaluating information security, risk management and organizational controls.

Examples of commonly referenced frameworks include:

• ISO/IEC 27001: Information security management systems.
• ISO/IEC 27002: Information security control guidance.
• NIST Cybersecurity Framework: Cybersecurity risk management guidance.
• SOC 2: Independent reporting on specified service organization controls.

Reference to these frameworks is provided for informational purposes only.

This page does not represent that Reedroux holds ISO certification, has completed a SOC 2 examination or has obtained any other independent compliance attestation.

Any certification or independent assurance claim should be supported by valid documentation identifying its scope and applicable entity.

Continuous Improvement

Technology, regulatory requirements and security threats continue to evolve.

Reedroux recognizes the importance of reviewing relevant practices as services and operational environments change.

Continuous improvement may involve evaluating security incidents, updating documentation, reviewing technical dependencies and considering changes in applicable law.

The scope and frequency of reviews should reflect the risks, resources and responsibilities associated with the relevant service.

Legal Documentation

Additional information about Reedroux's legal and privacy-related responsibilities is available through the following documents.

Privacy Policy

Explains how personal information may be collected, processed and protected.

Read Privacy Policy →

Terms of Service

Describes the general contractual conditions governing access to Reedroux services.

Read Terms of Service →

Legal Notice

Provides corporate identification and other relevant legal information.

Read Legal Notice →

Compliance Contact

For inquiries concerning legal compliance, privacy, information security or responsible technology operations, please contact Reedroux.

Please include sufficient information about your inquiry so that it can be directed to the appropriate team.