Information Security Policy

1. Purpose

UK Software Ltd recognises that information and information systems are critical business assets and must be protected against unauthorised access, misuse, disclosure, loss, corruption and disruption.

This Information Security Policy defines the high-level principles, objectives and controls used by UK Software Ltd to protect information processed, stored, transmitted or managed through its business operations, systems and services, including the TranSearch® platform.

The purpose of this Policy is to:

• protect the confidentiality, integrity and availability of information;
• support secure and reliable business operations;
• reduce operational, legal, financial and reputational risk;
• support compliance with contractual, regulatory and legal obligations;
• establish a risk-based framework for information security management;
• promote security awareness and responsible handling of information.

This Policy supports UK Software Ltd’s wider data protection, operational and risk management practices.

2. Scope

This Policy applies to:

• all employees, contractors, consultants and authorised third parties;
• all systems, applications, devices, networks and infrastructure operated or managed by UK Software Ltd;
• all information processed by UK Software Ltd in electronic, physical or verbal form;
• all hosted and on-premise deployments of TranSearch®;
• all supporting operational, development and support activities.

This includes information belonging to:

• UK Software Ltd;
• customers;
• suppliers;
• partners;
• employees;
• third parties.

This Policy also applies to third-party service providers that process or access information on behalf of UK Software Ltd where relevant contractual arrangements apply.

3. Security Objectives

UK Software Ltd’s information security objectives are to ensure that:

• information risks are identified, assessed and managed appropriately;
• information is accessible only to authorised individuals and systems;
• information remains accurate, complete and reliable;
• systems and services remain available and resilient;
• customer and business information is protected throughout its lifecycle;
• security responsibilities are clearly defined and communicated;
• security incidents are identified, reported and managed appropriately;
• legal, contractual and regulatory obligations are met;
• security controls remain proportionate to operational and business risk.

4. Information Security Principles

UK Software Ltd applies a risk-based approach to information security and seeks to implement appropriate technical, organisational and procedural safeguards based on:

• the sensitivity and classification of information;
• operational requirements;
• legal and regulatory obligations;
• customer expectations;
• industry good practice;
• evolving security threats and vulnerabilities.

Security controls are designed to support the following core principles:

Confidentiality

Information must only be accessible to authorised individuals and systems.

Integrity

Information must remain accurate, complete and protected from unauthorised modification or destruction.

Availability

Information and services must remain accessible and operational when required by authorised users.

5. Roles and Responsibilities

Information security is the responsibility of all individuals who access UK Software Ltd systems or information.

UK Software Ltd management is responsible for:

• overseeing information security governance;
• ensuring appropriate controls and resources are implemented;
• reviewing risks and security arrangements periodically;
• supporting compliance with this Policy.

Employees and authorised users are responsible for:

• complying with security policies and procedures;
• protecting credentials and access mechanisms;
• reporting actual or suspected security incidents promptly;
• handling information appropriately and securely.

Third parties with access to systems or information must comply with applicable contractual, confidentiality and security obligations.

6. Asset Management

UK Software Ltd maintains controls to identify, manage and protect information assets and technology resources.

Assets may include:

• information and records;
• databases;
• software and applications;
• infrastructure and hosting environments;
• cloud services;
• devices and equipment;
• user credentials;
• operational documentation.

Information assets are classified according to sensitivity, operational importance and legal or contractual requirements.

Appropriate retention, access, handling and disposal controls are applied based on the nature of the information involved.

7. Access Control

Access to systems and information is controlled according to business and operational requirements.

UK Software Ltd applies appropriate access management controls, which may include:

• role-based access permissions;
• authentication controls;
• password policies;
• least-privilege access principles;
• account provisioning and removal procedures;
• access reviews;
• logging and monitoring activities where appropriate;
• multi-factor authentication for administrative, privileged or remote access accounts where appropriate.

Privileged or administrative access is restricted to authorised personnel only.

Users are responsible for maintaining the confidentiality and security of authentication credentials.

8. Data Protection and Customer Information

UK Software Ltd recognises that customers may use TranSearch® to store or manage highly sensitive, confidential or regulated information, including records relating to personnel, healthcare, evidential materials, operational records or other protected data.

Customers remain responsible for:

• determining the lawful basis for processing personal data;
• configuring appropriate access controls;
• defining retention policies;
• ensuring compliance with applicable legal or regulatory obligations.

Where UK Software Ltd processes personal data on behalf of customers, processing activities are performed in accordance with applicable agreements, customer instructions and relevant data protection laws.

9. Cryptography and Data Protection Controls

UK Software Ltd uses appropriate technical measures designed to protect information during storage and transmission where applicable.

Security controls may include:

• encryption technologies;
• secure communication protocols;
• authentication controls;
• backup protections;
• monitoring and logging mechanisms;
• vulnerability and patch management processes.

No internet-based system or electronic transmission method can be guaranteed to be completely secure. However, UK Software Ltd uses reasonable and proportionate measures designed to reduce security risks and protect systems and information.

10. Physical and Environmental Security

Where applicable, systems and infrastructure used by UK Software Ltd are protected by physical and environmental security controls designed to reduce the risk of unauthorised access, damage or disruption.

Cloud-hosted infrastructure providers used by UK Software Ltd may implement additional physical security controls within their own facilities and environments.

11. Hosting and Infrastructure

TranSearch® may be deployed:

• as a cloud-hosted SaaS platform; or
• within customer-managed on-premise environments.

Cloud-hosted services may utilise UK-based infrastructure providers, including Hyve Managed Hosting and associated service providers.

For customer-managed or on-premise deployments, customers remain responsible for:

• infrastructure security;
• network security;
• endpoint protection;
• operating system management;
• backup and disaster recovery arrangements unless otherwise agreed in writing;
• customer-controlled access permissions and local environments.

12. Operational Security

UK Software Ltd maintains operational security processes designed to support secure and reliable service delivery.

Operational security activities may include:

• change management procedures;
• software maintenance and updates;
• vulnerability management;
• malware protection;
• monitoring and logging;
• backup procedures implemented in accordance with operational and service requirements;
• resilience and recovery planning;
• access auditing where appropriate;
• periodic security testing and vulnerability assessments where appropriate.

Security measures are reviewed periodically and may evolve in response to operational, technological or threat-related changes.

13. Supplier and Third-Party Security

UK Software Ltd may use carefully selected third-party providers to support business operations and service delivery.

Third-party providers may include:

• cloud hosting providers;
• productivity and collaboration providers;
• CRM and operational service providers;
• analytics providers;
• infrastructure and communications providers.

Where appropriate, UK Software Ltd seeks to ensure that suppliers handling information or supporting critical services implement suitable security measures and contractual protections.

14. Security Incident Management

UK Software Ltd maintains procedures for identifying, reporting, assessing and responding to information security incidents.

Security incidents may include:

• unauthorised access;
• data breaches;
• malware or ransomware activity;
• system compromise;
• accidental disclosure;
• service disruption;
• loss or theft of devices or information.

Actual or suspected security incidents should be reported promptly through appropriate internal channels.

Where required by law or contractual obligation, affected parties and regulators may be notified appropriately.

15. Business Continuity and Resilience

UK Software Ltd seeks to maintain appropriate business continuity and resilience arrangements designed to support the continued operation and recovery of critical systems and services.

This may include:

• backup processes;
• disaster recovery arrangements;
• resilience planning;
• infrastructure redundancy where appropriate;
• incident response procedures.

Recovery priorities and arrangements may vary depending on the nature of the service, hosting model and contractual agreements.

16. Compliance

UK Software Ltd seeks to comply with applicable:

• data protection legislation;
• contractual obligations;
• confidentiality obligations;
• regulatory requirements;
• information security responsibilities.

Security controls and practices may be reviewed periodically through operational reviews, risk assessments, internal reviews or third-party assessments where appropriate.

17. Policy Review

This Policy will be reviewed periodically and may be updated to reflect:

• legal or regulatory developments;
• operational changes;
• technology changes;
• emerging threats;
• business requirements;
• lessons learned from incidents or reviews.

Updated versions of this Policy may be published or communicated internally where appropriate.

18. Contact Information

UK Software Ltd
Kent Innovation Centre
Millennium Way
Thanet Reach Business Park
Broadstairs
Kent CT10 2QQ
United Kingdom

Company Number: 02856735
Email: info@uksoftware.co.uk
Telephone: 01843 609345