Information security

Version 1.0 · 22 October 2026 · Draft for formal adoption. Scope: MENSCH and relevant related legal entities, in accordance with contracts and applicable law.

1. Policy and objective

The objective is to preserve the confidentiality, integrity, and availability of information to an extent appropriate to business risk. The policy applies to employees, engaged persons, devices, services, and systems that process business information.

2. Roles and responsibilities

Management approves risks and resources. The system owner defines access and classification. Users protect accounts and report incidents. For each client and service it must be clear who manages infrastructure and who responds to incidents.

3. Information classification

Information is classified as public, internal, confidential, or strictly confidential. Confidential materials include client data, source code, contracts, configurations, and access secrets. Sharing and storage depend on the class.

4. Identity and access management

Unique user accounts are used where possible, least privilege, MFA for administrative and critical accounts when supported, timely revocation of access, and periodic review of privileges. Shared accounts are avoided or strictly controlled.

5. Passwords and secrets

Passwords and API keys are stored in dedicated secure stores, not in public repositories or open messages. Secrets are rotated when compromise is suspected. Production keys are not used in test environments without justification.

6. Devices and remote work

Work devices should use updated software, screen lock, encryption where available, and controlled access. A lost device is reported without delay. Use of personal devices requires appropriate data protection.

7. Network and infrastructure

Access to administrative services is restricted, network services are configured on a least-exposure basis, and security updates are planned according to risk. Firewall, WAF, and monitoring are introduced according to architecture and the contracted service.

8. Development and change

Development includes version control, separation of environments when justified, dependency checking, input validation, authorisation control, protection against common web vulnerabilities, and review of significant changes. Production changes must be traceable and reversible when needed.

9. MenschOS multi-tenant controls

Every request must verify identity, role, and tenant membership. Administrative operations, exports, files, job queues, and cache must respect tenant boundaries. Isolation is verified through tests and access controls.

10. Encryption and transmission

Appropriate transport protection is used for public services. Encryption of data at rest, key management, and rotation are defined according to risk and platform. Sensitive data are not sent over insecure channels.

11. Backup and recovery

For each managed system, backup frequency, retention period, location, authorisations, restore testing, and recovery targets are defined where contracted. Having a backup does not guarantee recovery of all data.

12. Records and monitoring

Required events on logins, privilege changes, and critical actions are collected, with minimisation of personal data. Logs are protected from unauthorised modification and retained for a defined period.

13. Incident response

An incident is reported, classified, contained, investigated, remediated, and documented. Evidence must be preserved, impact determined, and the client or authority notified when contract or law requires. After an incident, root cause analysis is carried out.

14. Suppliers and cloud

Before engagement, security and contractual risks, processing locations, sub-processors, export availability, and termination conditions are checked. Key suppliers are reviewed periodically.

15. AI tools

Entering confidential data or client source code into unapproved AI services is prohibited. Generated code undergoes appropriate quality, licence, and security review.

16. Retention and destruction

Data are retained according to legal and contractual periods. After expiry, data are deleted or anonymised when technically and legally possible. Access to archives is restricted.

17. Exceptions and review

Exceptions to the policy require documented approval, risk assessment, and an expiry date. The policy is reviewed at least annually or after a significant incident.

Document management

Responsible party: management of the relevant legal entity. Review: at least once a year. Effective date: date of formal adoption. Contact: hi@mensch.rs.