Governance
Security is owned at leadership level, with written policies covering information security, access control, acceptable use, incident response, vendor management and business continuity, reviewed at least annually.
People
- Background checks for staff where permitted by local law.
- Confidentiality agreements for every employee and contractor.
- Security and privacy training at onboarding and annually.
- Prompt removal of access when roles change or people leave.
Access control
- Least-privilege, role-based access to client environments, granted per engagement.
- Single sign-on and multi-factor authentication for internal systems.
- Separate credentials per client; no shared accounts.
- Access to production client data logged and reviewed.
Data protection
- Encryption in transit (TLS 1.2+) and at rest on managed infrastructure.
- Secrets kept in managed vaults, never in source code.
- Separation between development, staging and production environments.
- Backups with tested restoration for systems we host.
Secure engineering
Code review on every change, dependency and vulnerability scanning, and change management for client production systems. Integrations use vendor-supported APIs and scoped credentials wherever available.
Monitoring and incident response
Systems under Managed Business Operations are monitored across client business hours, with defined escalation paths. Our incident response plan covers detection, containment, client notification, remediation and post-incident review.
Report a vulnerability
Email security@ninjazgroup.com. Our responsible disclosure terms are set out in the Acceptable Use Policy.