Security Policy

Our Security Commitment

At Choice Voting, we prioritise the security of our systems and data above all else. As we utilise Amazon Web Services (AWS) in the London region, we are committed to maintaining the highest standards of security to ensure the confidentiality, integrity, and availability of our resources and sensitive information.

Zero Trust Security Architecture

Choice Voting implements a comprehensive zero trust security model across all our applications and services. This means:

• No implicit trust based on network location or asset ownership
• All access requires strict authentication and authorization
• Continuous validation of security posture at every access attempt
• Least privilege access principles enforced across all systems
• Microsegmentation of network resources and applications
• End-to-end encryption for all data in transit and at rest

Administrative Access Controls

Our zero trust approach to administrative access includes:

• Just-in-time access provisioning for administrative functions
• Time-limited access tokens for all administrative operations
• Multi-factor authentication required for all privileged access
• Granular role-based access control (RBAC) implementation
• Complete audit logging of all administrative actions
• Regular access reviews and automatic privilege expiration

Data Encryption and Protection

• All data transferred between our systems and AWS services is encrypted using industry-standard TLS protocols
• Data at rest is encrypted using AWS services such as Amazon S3 Server-Side Encryption and Amazon RDS encryption
• Sensitive data is encrypted using strong encryption algorithms before being stored or transmitted
• Encryption key management follows strict rotation and access control policies

Network Security

• Virtual Private Clouds (VPCs) isolate resources within AWS
• Network Access Control Lists (NACLs) and Security Groups control inbound and outbound traffic
• Regular security audits and vulnerability assessments of our VPCs and network configurations
• Advanced threat detection and prevention systems
• Real-time network monitoring and anomaly detection

Logging and Monitoring

• AWS CloudTrail enabled for detailed API activity logging
• CloudWatch Logs and CloudWatch Metrics for comprehensive monitoring
• Real-time alerts configured for security breaches or anomalies
• Continuous security posture assessment
• Regular security compliance audits

Disaster Recovery and Business Continuity

• Regular automated backups of all critical data
• Geographically distributed backup storage
• Tested disaster recovery procedures
• Business continuity planning and regular testing
• Redundant systems and failover capabilities

Compliance and Certifications

• Regular third-party security assessments
• Compliance with GDPR and UK data protection regulations
• Industry standard security frameworks implementation
• Regular security training for all staff members
• Regular penetration testing audits

Incident Response

• Documented incident response procedures
• Regular incident response training
• Automated threat detection and response
• Clear communication protocols for security incidents