Information Security & Data Handling Policy

1. Core principles

• Least privilege: access only where required for the role or task.
• Data minimisation: process only what is reasonably required.
• Purpose limitation: do not reuse data for incompatible purposes without assessment.
• Confidentiality: protect Client and commercially sensitive information.
• Traceability: retain appropriate records of material processing and changes.

2. Credentials and authentication

Credentials must not be shared unnecessarily. Strong unique passwords and multi-factor authentication should be used where supported. Secrets, API keys and tokens should be stored in appropriate credential stores or platform secret mechanisms rather than embedded in public documents or unsecured communications.

3. Approved systems

Operational data should be processed through approved systems and providers appropriate to the workflow. New material providers should be assessed before production use where they will handle personal, Client-confidential or security-sensitive information.

4. Data export and sharing

Exports should be limited to the fields and recipients required for the task. Client information must not be shared with unrelated clients. Sensitive configuration, credentials and security details should not be placed in public Trust Centre material.

5. Disposal

Data that no longer has a valid purpose should be deleted or anonymised in accordance with the retention framework, subject to contractual, legal, backup and suppression requirements.

6. Security events

Suspected unauthorised access, disclosure, loss, malware, credential compromise or other material security event must be escalated promptly to the relevant Sentra director or nominated operational owner for triage and response.