Risk & Security Management

Security risks and dependencies are reviewed as part of our broader information security and risk management processes.
‍

Security controls are maintained and updated as services, systems, client requirements, and relevant risks evolve.

Security Policies

Employees and contractors are subject to applicable security requirements, including acceptable use, confidentiality, access control, customer data handling, and incident reporting requirements.

Security Awareness

Security awareness training is mandatory for employees and refreshed periodically.
‍

Training covers areas including:
‍

• phishing and social engineering;
• credential security;
• customer data handling;
• acceptable use;
• security incident reporting.

Individual Access

Each user is assigned individual credentials. Shared accounts and credential sharing are prohibited.

Role-Based Access

Access is provisioned based on the user's role, responsibilities, and relevant client or service assignment.

Least Privilege

Permissions are limited to the minimum scope necessary to perform assigned responsibilities.

Multi-Factor Authentication

MFA is enforced for applicable systems, including privileged and administrative access where supported.
‍

SSO is used where supported by the relevant system.

Access Reviews

Access rights are periodically reviewed and adjusted when responsibilities or client assignments change.
‍

Access is revoked promptly when employment or a client assignment ends.

Client Segregation

Access to client environments is segregated and granted only where required for the relevant service scope.

Identity & Access Management

We apply identity and access management controls across internal systems and client environments, where applicable, to ensure that access is granted only to authorized users and remains appropriate to their responsibilities.

Access Control Principles

Access is provisioned based on the user’s role, assigned responsibilities, and relevant client or service scope.

Our access management approach includes:

• individual user accounts; shared accounts are not permitted;
• role-based access control (RBAC);
• least privilege and deny-by-default principles;
• permissions limited to the minimum scope necessary for assigned responsibilities;
• access to client systems limited to the systems and permissions required for the relevant service scope;
• segregation of access between different client environments.

Access to client data and systems is granted only after the user is assigned to the relevant client or service scope.

Authentication & Credential Security

Multi-factor authentication (MFA) is enforced for applicable systems, including privileged and administrative access where supported by the system.

Single Sign-On (SSO) is used where supported by the applicable system.

Password requirements are defined and enforced through internal security policies. Credential sharing is prohibited, and credentials are stored and managed using approved secure credential management solutions.

Access Lifecycle

Access provisioning and revocation are managed through defined internal procedures.

Access rights are periodically reviewed to confirm that they remain appropriate and necessary. Permissions are reviewed and adjusted when a user’s role or responsibilities change.

Access is revoked promptly when employment or a client assignment ends and is removed whenever it is no longer required. Access to client environments is not retained between assignments unless there is a valid ongoing business need.

Temporary or time-limited access may be used where appropriate for specific tasks or roles.

Privileged Access

Privileged and administrative access is restricted to specifically authorized personnel and subject to additional controls.

Privileged access is reviewed as part of the regular access review process.

Logging & System Controls

Audit logging is enabled where supported by the applicable system to provide visibility into access and administrative activities.

Automatic session timeout and related session controls are used where supported by the applicable system.

For client-managed systems, certain IAM controls may depend on the configuration and capabilities of the client environment.

IAM controls are reviewed and updated as part of the company’s broader information security management process.

Endpoint Protection

Devices used for work are protected by required MDR/antivirus controls, with security alerts centrally monitored.

Secure Device Access

Work devices are protected by passwords that meet defined complexity requirements and automatic screen locking.

Customer Data Protection

Customer data must remain within approved systems.
‍

Local storage, printing, personal applications, and unauthorized storage channels are prohibited for customer data.

External Media

USB and external storage devices are prohibited for work involving customer data.

BYOD Security

BYOD may be used where devices meet defined baseline security requirements.
‍

Security and customer data handling requirements apply regardless of whether the device is company-owned or BYOD.

Secure Remote Workspace

Remote workspaces must prevent unauthorized viewing or access to customer information and follow clean desk and clean screen principles.
‍

VPN may be required depending on the applicable client environment.

We apply endpoint and remote work security requirements to protect customer data and maintain secure access to internal and client environments, regardless of whether work is performed from a corporate-owned device or an approved BYOD device.

Endpoint Protection

Devices used for work are required to meet defined baseline security requirements.

Our endpoint security controls include:

• MDR/EDR protection on devices used for work;
• centralized monitoring of endpoint security alerts;
• password-protected device access;
• automatic screen locking;
• mandatory device locking whenever a device is left unattended;
• prohibition of unauthorized software installation;
• prohibition of USB and external storage devices for work involving customer data.

BYOD is permitted only where the device meets defined security requirements.

Customer Data Handling

Customer data must remain within approved systems and must not be stored locally, printed, or copied into personal applications, storage, or communication channels.

Devices used for work must not be shared with unauthorized persons.

Work credentials must not be stored in browsers and are managed through approved secure credential management solutions.

Remote Workspace Security

Remote work is subject to the same confidentiality and customer data handling requirements as office-based work.

Remote workspaces must be arranged to prevent unauthorized viewing or access to customer data, including adherence to clean desk and clean screen principles.

Work from public locations may be permitted only where applicable security and privacy requirements can be maintained.

Use of public Wi-Fi is discouraged and may be subject to additional security requirements depending on the client environment.

VPN may be required depending on the client’s security requirements or environment.

Security Incident Reporting

Potential endpoint security concerns are promptly reported through the company’s established security incident process to support timely assessment and response.

Client-Specific Requirements

Remote work requirements and endpoint controls may be strengthened where required by specific client security requirements.

Endpoint and remote work security requirements are reviewed and updated as part of the company’s broader information security management process.

We process customer personal data as a Data Processor, only within the agreed service scope and in accordance with the client’s instructions, applying data protection practices designed to support compliance with applicable privacy requirements, including the GDPR where applicable.

Processing of Customer Data

The categories of personal data processed, purposes of processing, and applicable handling requirements depend on the specific client setup and agreed service scope.
‍

Customer personal data may be processed within client-managed systems or approved company systems, depending on the delivery setup.
‍

Customer personal data:
‍

• is processed solely for the agreed service purposes and is not used for unrelated commercial purposes;
• remains within approved systems unless otherwise required by the agreed service setup;
• is not stored locally on employee devices;
• is accessible only to authorized personnel assigned to the relevant client or service;
• is protected by confidentiality obligations.

Access is granted on a need-to-know and least-privilege basis and is reviewed when roles or client assignments change. Access between client environments is segregated.

Sensitive Data

Highly sensitive or special-category personal data is not processed by default.
‍

Where such processing is required, the use case is subject to a dedicated compliance review before being introduced into the service.

Access & Confidentiality

Personnel with access to customer personal data are subject to confidentiality obligations.
‍

Access rights are regularly reviewed and are adjusted or revoked when an employee changes roles, moves between client accounts, or leaves the company.

Data Processing Agreements

Where applicable, we enter into Data Processing Agreements (DPAs) with clients to define the requirements and responsibilities applicable to the processing of personal data.
‍

Approved third-party service providers may be used to support service delivery and are subject to applicable contractual and data protection requirements. We notify clients of any intended changes concerning the addition or replacement of third-party service providers.
‍

Data Breaches

In the event of a personal data breach, EverHelp notifies the affected client without undue delay, outlining the nature of the breach, expected impacts, and remedial measures. EverHelp immediately investigates, mitigates, and remedies any incident to protect personal data.
‍

Data Retention and Deletion

Customer-specific retention and deletion requirements can be supported based on the agreed service setup and technical capabilities.
At the end of an engagement, access to customer systems is revoked immediately.
‍
Where customer data is held within our service environment, customers may request data export, transfer, or deletion as part of the offboarding process.
‍

EverHelp may retain customer data only to the extent and for the duration required by applicable privacy laws. Any retained data will remain strictly confidential, isolated from further processing, and used exclusively to satisfy applicable legal obligations.
‍

Data Subject Requests

Where we act as a Data Processor and receive a request directly from an end user regarding their personal data, we route the request to the relevant customer without undue delay and support its fulfillment in accordance with the customer’s instructions.

Subprocessors

The list of subprocessors engaged in providing the services is agreed with the client and documented in the applicable agreement. If any changes are made to the approved subprocessor list, the client is notified in accordance with the agreed contractual terms.
‍
Customer-specific requirements regarding the use of particular technology providers can also be considered as part of the service setup.

‍

Incident Management, Business Continuity & Resilience

We maintain formal incident management, business continuity, and disaster recovery processes to support timely response to security events and maintain critical service delivery during disruptions.
‍

These processes are integrated into our broader Information Security Management System (ISMS) and are reviewed and updated as our services, systems, and critical dependencies evolve.

Security Incident Management

A formal Security Incident Response Plan defines the roles and responsibilities involved in responding to security incidents.
‍

Suspected or confirmed security incidents must be reported immediately through defined internal reporting channels.
‍

Depending on the nature and impact of the incident, response activities may include investigation, containment, recovery, and coordination with relevant internal and external stakeholders.
‍

Where an incident affects a client or client data, affected clients are notified in accordance with applicable contractual and legal requirements.
‍

Where appropriate, affected clients may also receive a Root Cause Analysis (RCA) and relevant follow-up information.
‍

Following significant incidents, post-incident reviews are performed to identify root causes, lessons learned, and opportunities to strengthen existing controls.
‍

The Incident Response Plan is regularly tested through tabletop or other response exercises.

Business Continuity

We maintain a formal Business Continuity Plan (BCP) covering critical business processes and services.
‍

Business continuity planning is designed to:
‍

• maintain critical service delivery during disruptions;
• support timely recovery of affected operations;
• address both technology disruptions and workforce availability risks;
• consider critical third-party services and dependencies;
• prioritize recovery activities based on the criticality of the affected service or process.

Business continuity responsibilities are assigned to defined roles and owners.
‍

Critical roles and functions have backup coverage to support continuity where key personnel become unavailable.
‍

Our distributed operating model also helps reduce dependency on any single physical location as part of the overall continuity approach.

Operational Resilience

Continuity measures are maintained for scenarios that may affect day-to-day service delivery, including local internet or power disruptions and temporary workforce unavailability.
‍

Where required, work may be redistributed between available personnel or teams to support continuity of service.
‍

Critical third-party services and vendors are considered as part of continuity planning, and contingency measures are maintained for disruption of key systems or dependencies.
‍

Client-specific continuity requirements may be incorporated into the agreed delivery setup where applicable.

Disaster Recovery

A formal Disaster Recovery Plan (DRP) forms part of the broader resilience framework.
‍

Specific recovery objectives, including RTO/RPO targets and other continuity commitments, may vary depending on the service and agreed client requirements rather than applying universally across all services.
‍

Business continuity and disaster recovery documentation is maintained and updated when material changes occur in operations, systems, or critical dependencies.

Testing & Continuous Improvement

Business continuity and disaster recovery arrangements are regularly reviewed and tested.
‍

Testing may include tabletop, simulation, or other continuity exercises. Results are reviewed and used to improve continuity arrangements where needed.
‍

Employees involved in critical operations are made aware of their continuity responsibilities and expected actions during disruptions.
‍

Business continuity risks and dependencies are periodically reviewed as part of the broader risk management process.

Client Communication During Disruptions

Significant service disruptions are escalated internally based on their potential impact on critical operations and client delivery.
‍

Where a disruption affects a client, relevant communication is provided regarding the impact and recovery status. During significant disruptions, affected clients may receive status updates through recovery, as appropriate.
‍

Security incident management and business continuity processes may operate in parallel where an incident affects service availability or other critical operations.
‍

Following a significant disruption, response effectiveness and continuity measures are reviewed and improved where needed.

‍

Incident Management, Business Continuity & Resilience

We maintain formal incident management, business continuity, and disaster recovery processes to support timely response to security events and maintain critical service delivery during disruptions.
‍

These processes are integrated into our broader Information Security Management System (ISMS) and are reviewed and updated as our services, systems, and critical dependencies evolve.

Security Incident Management

A formal Security Incident Response Plan defines the roles and responsibilities involved in responding to security incidents.
‍

Suspected or confirmed security incidents must be reported immediately through defined internal reporting channels.
‍

Depending on the nature and impact of the incident, response activities may include investigation, containment, recovery, and coordination with relevant internal and external stakeholders.
‍

Where an incident affects a client or client data, affected clients are notified in accordance with applicable contractual and legal requirements.
‍

Where appropriate, affected clients may also receive a Root Cause Analysis (RCA) and relevant follow-up information.
‍

Following significant incidents, post-incident reviews are performed to identify root causes, lessons learned, and opportunities to strengthen existing controls.
‍

The Incident Response Plan is regularly tested through tabletop or other response exercises.

Business Continuity

We maintain a formal Business Continuity Plan (BCP) covering critical business processes and services.
‍

Business continuity planning is designed to:
‍

• maintain critical service delivery during disruptions;
• support timely recovery of affected operations;
• address both technology disruptions and workforce availability risks;
• consider critical third-party services and dependencies;
• prioritize recovery activities based on the criticality of the affected service or process.

Business continuity responsibilities are assigned to defined roles and owners.
‍

Critical roles and functions have backup coverage to support continuity where key personnel become unavailable.
‍

Our distributed operating model also helps reduce dependency on any single physical location as part of the overall continuity approach.

Operational Resilience

Continuity measures are maintained for scenarios that may affect day-to-day service delivery, including local internet or power disruptions and temporary workforce unavailability.
‍

Where required, work may be redistributed between available personnel or teams to support continuity of service.
‍

Critical third-party services and vendors are considered as part of continuity planning, and contingency measures are maintained for disruption of key systems or dependencies.
‍

Client-specific continuity requirements may be incorporated into the agreed delivery setup where applicable.

Disaster Recovery

A formal Disaster Recovery Plan (DRP) forms part of the broader resilience framework.
‍

Specific recovery objectives, including RTO/RPO targets and other continuity commitments, may vary depending on the service and agreed client requirements rather than applying universally across all services.
‍

Business continuity and disaster recovery documentation is maintained and updated when material changes occur in operations, systems, or critical dependencies.

Testing & Continuous Improvement

Business continuity and disaster recovery arrangements are regularly reviewed and tested.
‍

Testing may include tabletop, simulation, or other continuity exercises. Results are reviewed and used to improve continuity arrangements where needed.
‍

Employees involved in critical operations are made aware of their continuity responsibilities and expected actions during disruptions.
‍

Business continuity risks and dependencies are periodically reviewed as part of the broader risk management process.

Client Communication During Disruptions

Significant service disruptions are escalated internally based on their potential impact on critical operations and client delivery.
‍

Where a disruption affects a client, relevant communication is provided regarding the impact and recovery status. During significant disruptions, affected clients may receive status updates through recovery, as appropriate.
‍

Security incident management and business continuity processes may operate in parallel where an incident affects service availability or other critical operations.
‍

Following a significant disruption, response effectiveness and continuity measures are reviewed and improved where needed.

Independent Penetration Testing

Independent external penetration testing is performed at least annually and following major changes where appropriate, based on the applicable technical scope.

Vulnerability Reviews

Vulnerability scanning is performed where supported by relevant systems and tools.
‍

Security configurations for systems under our control are periodically reviewed.

Independent Assurance

Technical testing is complemented by applicable external certification and compliance assessments.
‍

Detailed technical findings are not publicly disclosed. Where relevant, customers may receive high-level assurance information regarding completed security testing.

Vulnerability & Security Testing

We maintain a structured vulnerability management and security testing approach to identify security weaknesses, validate the effectiveness of relevant controls, and support continuous improvement of our security posture.
‍

Security testing activities and related controls are reviewed as part of the company’s broader Information Security Management System (ISMS).

Penetration Testing

Independent external penetration testing is performed at least annually and following major changes where appropriate, based on the applicable technical scope.
‍

Penetration testing is performed by qualified independent external specialists.
‍

Security testing priorities and scope may vary depending on the nature of the asset, system, or material change.

Vulnerability & Configuration Reviews

Vulnerability scanning is performed where supported by the relevant systems and tools.
‍

Security configurations for systems under our control are periodically reviewed and adjusted where needed.
‍

Security testing and assurance activities may include:
‍

• independent penetration testing;
• vulnerability scanning;
• security configuration reviews;
• additional security reviews following relevant material changes;
• independent certification and compliance assessments.

Review & Improvement

Results of security testing are reviewed by the responsible teams and used to identify and implement security improvements where appropriate.
‍

Identified security weaknesses are addressed based on their relevance and potential impact.
‍

Results of penetration tests, vulnerability assessments, and security reviews are also used to improve relevant security controls and configurations.
‍

The applicable security testing scope is reviewed when material changes occur to company-managed assets or environments.

Independent Assurance

Technical security testing is complemented by independent certification and compliance assessments.
‍

These assessments provide an additional layer of assurance over the company’s broader security management practices and are separate from technical penetration testing or vulnerability scanning.

Customer Assurance

Where relevant, customers may be provided with appropriate high-level assurance information, such as:
‍

• confirmation that independent penetration testing has been performed;
• testing date and applicable scope;
• high-level or summarized testing outcomes.

Continuous Review

Vulnerability management and security testing activities are periodically reviewed to ensure they remain appropriate as the company’s systems, services, and security requirements evolve.

Employment Verification

Employment history verification forms part of the standard hiring process.
‍

Where required, clients may perform additional background screening subject to candidate consent and applicable legal requirements.

Confidentiality

Employees and contractors with access to customer information or client environments are subject to confidentiality obligations.
‍

These obligations continue after the employment or contractual relationship ends.

Security Training

Security awareness training is mandatory and refreshed periodically.

Role Changes & Offboarding

Access and applicable security requirements are reviewed when roles or assignments change.
‍

Formal offboarding includes access revocation and return of company-owned assets where applicable.

People Security

We maintain people security controls throughout the employee and contractor lifecycle to help protect customer data, client environments, and company systems.
‍

These controls apply to employees, contractors, and temporary staff involved in service delivery.

Hiring & Pre-Employment Checks

Employment history verification is part of the standard hiring process.
‍

Where additional screening is required by a client, further background checks may be performed by the client, subject to candidate consent and applicable legal requirements.

Confidentiality & Conduct

All employees and contractors with access to client systems or customer data are subject to mandatory confidentiality obligations.
‍

Access to personal data is granted strictly on a need-to-know basis. Personnel are required to be fully aware of and compliant with applicable сontractual obligations, DPAs, client written instructions, and applicable privacy laws.
‍

These obligations remain in effect throughout the employment or contractual relationship and continue after it ends.
‍

Employees are also subject to conflict of interest, anti-bribery, acceptable conduct, and related governance requirements.

Security Awareness & Training

Security awareness training is mandatory for all employees.
‍

Training covers relevant topics including:
‍

• phishing and social engineering;
• credential handling;
• customer data handling;
• acceptable use requirements;
• security incident reporting.

Security awareness training is refreshed periodically and may be updated as new risks, threats, or requirements emerge.
‍

Client-specific security or confidentiality briefings may also be provided where required by the applicable client environment or service scope.

Security Policies & Responsibilities

Employees are required to acknowledge applicable security policies and acceptable use requirements.
‍

Security and confidentiality requirements are communicated during onboarding and remain applicable throughout the employment or contractual relationship.
‍

Suspected security incidents, suspicious activity, phishing attempts, or potential violations of customer data handling requirements must be reported promptly through the appropriate internal channels.
‍

Violations of security policies or customer data handling requirements may result in corrective or disciplinary action in accordance with internal procedures.

Role Changes & Offboarding

Role changes and internal transfers trigger a review and adjustment of relevant access rights and security requirements.
‍

A formal offboarding process includes appropriate security steps such as:
‍

• revocation of system and client access;
• return of company-owned equipment and assigned assets;
• closure of access associated with the employee’s role or client assignment.

Confidentiality obligations continue to apply after offboarding.

Governance

People Security controls are reviewed as part of the company’s broader Information Security Management System (ISMS) and security governance processes.

Third-party & Subprocessor Management

We maintain a structured third-party and subprocessor management process to help ensure that external providers supporting our operations meet relevant security, privacy, compliance, and service requirements.
‍

Only approved vendors and subprocessors may be used for company or customer-related operations.

Vendor Due Diligence

New third-party tools and vendors are reviewed before they are introduced into customer-related operations.
‍

Vendor onboarding may include review of:
‍

• security documentation and controls;
• privacy requirements;
• relevant certifications and assurance evidence;
• contractual terms;
• operational dependencies;
• anti-money laundering (AML) and sanctions screening;
• compliance requirements relevant to the service.

Security and compliance evidence is reviewed before onboarding and periodically thereafter, where applicable.
‍

Relevant third-party risks are considered as part of our broader information security and risk management processes.

Ongoing Vendor Review

Third-party providers supporting critical services are monitored for continued suitability and security posture.
‍

Vendor selection and ongoing review take into account the provider’s relevance to customer data, service delivery, and business continuity.
‍

Material changes to a vendor’s:
‍

• service;
• security posture;
• certifications;
• AML and sanctions status;
• compliance status;

may trigger reassessment and further review.
‍

Vendors and subprocessors are expected to maintain appropriate security and privacy safeguards for the services they provide.

Subprocessor Management

Subprocessors are reviewed and approved before being introduced into customer-related processing.
‍

Their use is limited to services necessary to support agreed customer-related processing or delivery activities.
‍

Subprocessors are subject to applicable confidentiality, privacy, security, and contractual requirements.
‍

Where applicable, subprocessor-related requirements may also be defined through the relevant Data Processing Agreement (DPA) or other contractual agreements with the client.
‍

The use of subprocessors does not change our responsibility to the client for the services we provide.

Subprocessor Transparency

We maintain an inventory of relevant third-party providers and subprocessors.
‍

Clients are provided with the list of subprocessors engaged in connection with the relevant services. Where we intend to add or replace a subprocessor, we notify the client in advance in accordance with the applicable contractual arrangements and, where required, reflect such changes in the relevant agreement or data processing terms. Clients may also request an up-to-date list of subprocessors at any time.
‍

The subprocessor list is limited to providers relevant to customer-related processing or service delivery rather than the company’s full internal vendor stack.
‍

Clients are informed of material changes to the subprocessor landscape where those changes are relevant to the services they receive.

Third-party Security Incidents

Vendors and subprocessors are expected to notify us of material security incidents or data breaches that could affect the services or data they support.
‍

Where a third-party incident may affect client data or service delivery, the potential impact is assessed and appropriate follow-up actions are taken.

Governance

Third-party and subprocessor management is aligned with our privacy, security, and contractual obligations to clients.
‍

These processes are reviewed and updated as part of the company’s broader Information Security Management System (ISMS).

AI Security & Governance

We use AI technologies in a controlled manner and apply security, privacy, and governance principles to their use across customer delivery and internal operations.
‍

AI use depends on the specific use case, client requirements, and agreed service setup.

Core Principles

Our approach to AI is based on the following principles:
‍

Defined purpose — AI is used only for clearly defined business or service purposes.
‍

Data minimization — AI systems receive access only to the customer data necessary for the relevant use case.
‍

Customer data protection — customer data processed through AI-enabled solutions remains subject to the same confidentiality, access control, and data handling requirements as other customer data.
‍

No public model training — customer data is not used to train public or shared AI models.
‍

Client separation — AI-enabled processing is logically segregated between client environments where applicable.
‍

Human oversight — the level of human review and oversight is determined based on the use case, level of automation, and potential impact.
‍

Responsible automation — AI is not used to make fully automated decisions (including profiling) that produce legal effects concerning individuals or similarly significantly affect them.
‍

Security & privacy review — AI tools and providers used in customer delivery are subject to appropriate internal security and privacy review.
‍

Quality oversight — AI-generated outputs may be monitored or reviewed for quality and appropriateness depending on the use case.
‍

Impact assessments — prior to deploying AI solutions that involve high-risk processing of personal data, appropriate Data Protection Impact Assessments (DPIA) are conducted.
‍

AI literacy & enablement — personnel involved in deploying, operating, or overseeing AI tools receive appropriate training to ensure a sufficient level of AI literacy, enabling the safe, secure, and compliant use of these technologies.
‍

Transparency & disclosure — individuals are clearly informed when they are interacting with an AI system (e.g., chatbots, automated agents) or when significant content has been artificially generated or manipulated, ensuring alignment with transparency obligations.
‍

Risk classification and prohibited practices — AI practices categorized as unacceptable under applicable regulations (such as social scoring, subliminal manipulation, or deceptive techniques) are strictly prohibited, and an internal framework is maintained to evaluate and classify AI systems by risk level, applying dedicated compliance controls to high-risk AI use cases.
‍

Compliance — AI use is expected to align with applicable client requirements, contractual commitments, and relevant legal and regulatory requirements.

Governance

AI-related controls are reviewed as part of the company’s broader security and compliance processes.
‍

AI use may also be reassessed when there are material changes to the tool, provider, model, use case, client requirements, or applicable regulatory expectations.