Information Security Policy

Information Security Policy

Version: 1.1 · Owner: Pocket PMO Ltd · Approval status: Approved · Review date: annually

1. Purpose

This policy sets out how Pocket PMO Ltd manages information security across the Pocket PMO platform. It applies to all Pocket PMO personnel, contractors, and service providers, and to all information systems used to deliver the platform.

2. Scope

• The Pocket PMO application (pocketpmo.co.uk), mobile shells and PWA.
• The managed backend (managed Postgres via Lovable Cloud and edge functions).
• All customer data processed by the platform.
• Third-party services listed in the Sub-Processor Register.

3. Principles

• Least privilege by default.
• Defence in depth: RLS + application checks + platform controls.
• Approval-first for AI actions.
• Auditability: every state change is attributable.
• Transparency: publish honestly on the Trust Centre; if we cannot demonstrate something, we say so.

4. Roles and responsibilities

• Managing Director / Data Controller: overall accountability. Owner confirmation L-01.
• Privacy lead: DPIA maintenance, data subject rights, sub-processor register. Owner confirmation L-03.
• Engineering lead: application security, RLS review, deployment.
• Ops / on-call: incident response, monitoring, secret custody.

5. Access control

• Managed authentication (email/password, Google, Apple, SAML SSO on request).
• MFA (TOTP) is available on every account. It is optional for all users and strongly recommended for administrators (S-08).
• Roles held in user_roles and evaluated by public.has_role SECURITY DEFINER function.
• Platform-level administrative access is restricted to named engineers; impersonation is logged in admin_impersonation_sessions with a reason.

6. Data protection

• Encryption at rest (AES-256) and in transit (TLS 1.3).
• Row Level Security on every business table with explicit GRANT statements per migration.
• Secrets never shipped to the browser; managed in the hosting console.
• Backups managed by the platform provider (owner-confirmation H-03).

7. Change management and SDLC

• Version-controlled code; automated build and typecheck.
• Migrations executed via the platform's migration tool, which enforces the GRANT-per-table invariant.
• Security scanner runs on the database schema (RLS coverage, GRANTs, public schema exposure).
• Feature flags and staged rollouts where appropriate.
• Owner confirmation required: formal peer-review policy and change-management ticketing (C-6).

8. Vulnerability management

• Application dependencies scanned; upgrades applied on a routine cadence.
• Public disclosure route: admin@pocketpmo.co.uk.
• Independent penetration test — owner-confirmation S-01.

9. Logging and monitoring

• audit_logs, wip_change_log, security_events, failed_login_attempts, rate_limits, edge-function logs, database logs.
• Sentry error monitoring (where enabled).
• Public intake is validated against the named account and organisation, sanitised, length-limited and protected by source and account rate limits before records are accepted.
• Retention — 12 months (S-09, confirmed 15 Jul 26).

10. Secrets management

• Server-only secrets stored in the platform vault (Lovable Cloud secrets).
• LOVABLE_API_KEY managed via the platform's rotation tool.
• Rotation cadence: at least every 12 months and on the offboarding of any individual with access (S-02).

11. Third-party risk

• Sub-processors are enumerated in the Sub-Processor Register.
• Annual review of each sub-processor is planned (D-3 in the gap analysis).

12. Incident response

• See the Incident Response Policy for the full workflow.
• Customer notification within 72 hours of confirmed personal-data breach.

13. Acceptable use

• See the Acceptable Use Policy. Customers must not upload special-category data unless expressly permitted, and must not misuse AI features for prohibited purposes.

14. Policy review

Reviewed annually and on any material change to the platform (new sub-processor, new integration category, new AI provider).

Owner confirmation required

• S-02 rotation, S-07 IR rota, S-08 MFA, S-09 audit retention (12m) and L-06 insurance (available under NDA) — all confirmed 15 Jul 26. Still Open: C-6 SDLC / peer-review policy.

Document history