Security Policy

Introduction

This Security Policy defines the principles, responsibilities and measures adopted by Cleared Tech FZE and Cleared Aerospace group companies to protect information and information systems.

Security Objectives

Compliance Standards

Our security policy is aligned with the following standards:

• GDPR - Art. 32 - Security of processing
• ISO/IEC 27001 - Information Security Management System
• OWASP Top 10 - Most critical application vulnerabilities
• PCI-DSS - Payment data security (via Stripe)
• NIST - Cyber risk management framework

Information Classification

All information is classified into four levels:

Access Control

Fundamental Principles

• Need-to-know: Access only to data needed for the role
• Least privilege: Minimum necessary permissions
• Separation of duties: No user can complete a critical process alone
• Defense in depth: Multiple layers of control

Authentication

• Password: minimum 12 characters, complexity required
• MFA mandatory for administrators and production access
• Session timeout: 15 min (admin), 30 min (users)
• Account lockout after 5 failed attempts

Authorization (RBAC)

Access is based on roles with granular permissions:

Encryption

In Transit

• TLS 1.3 on all HTTPS connections
• HSTS enabled (1 year)
• Perfect Forward Secrecy (PFS)

At Rest

• AES-256-GCM for database and storage
• AWS KMS for key management
• Automatic key rotation (annual)

Passwords

• Hash with Argon2id
• Unique salt per password
• Never stored in plain text

Application Security

We follow a Secure Development Lifecycle (SDL) for software development.

OWASP Top 10 Mitigations

Secure Development Lifecycle

1. Security requirements in analysis phase
2. Threat modeling in design phase
3. Secure coding standards and code review
4. Security testing (SAST, DAST, pentest)
5. Hardening and security monitoring

Security Testing

• Static Application Security Testing (SonarQube)
• Dependency scanning (Dependabot, Snyk)
• Annual third-party penetration test

Vulnerability Management

Vulnerabilities are classified and remediated according to defined SLAs:

Incident Management

We have a structured process for security incident response:

Incident Response Process

1. Preparation: Documented plan, trained team, ready tools
2. Identification: Detection through monitoring, log analysis, reports
3. Containment: Isolation, blocking, quarantine
4. Eradication: Root cause removal, patching, cleanup
5. Recovery: Service restoration, integrity verification
6. Lessons Learned: Post-incident analysis, improvements

Incident Classification

Business Continuity and Disaster Recovery

We ensure operational continuity with defined objectives:

Implemented Measures

• Multi-AZ deployment (high availability)
• Cross-region replica for disaster recovery
• Auto-scaling for resilience
• Daily encrypted backups
• Quarterly DR testing

Physical Security

Physical security is ensured at multiple levels:

Data Center (AWS)

• We exclusively use certified AWS data centers
• SOC 2 certification
• ISO 27001 certification

Corporate Devices

• Mandatory disk encryption (FileVault/BitLocker)
• Mobile Device Management for all devices
• Remote wipe enabled

Monitoring and Audit

We perform continuous system monitoring:

• Real-time monitoring: Automatic alerts on anomalies
• Centralized logging: All security events tracked
• Alerts and notifications: Automatic escalation for incidents
• Periodic audits: Quarterly control review

Vulnerability Reporting

If you discover a security vulnerability, we encourage you to report it responsibly:

Contact

For security questions: