Skip to main content
LEGAL

Security Statement

ITS Security Practices

Physical Security
Access to our offices and any facilities housing client systems or data is restricted to authorized personnel. Visitor access is controlled according to the security procedures of each facility. Systems that store or process client data are hosted in facilities with their own physical security controls, consistent with industry standards for data center access.
Network and Infrastructure Security
We maintain layered network defenses, including firewalls, intrusion detection and monitoring, and segmentation between internal systems and client-facing services. Our infrastructure is patched and monitored on an ongoing basis, and we perform regular vulnerability assessments to identify and address security risks as part of our ongoing security program.
Data Protection
We encrypt sensitive data in transit and, where supported by the system involved, at rest. Access to client data is limited to authorized personnel who need it to deliver the applicable service and is reviewed periodically. Backups are maintained and tested as part of our own business continuity planning, separate from any backup services we provide to clients.
Access Control
Access rights are assigned based on role and are updated or removed when an employee changes roles or leaves the company.
Employee Security Practices
All employees complete security awareness training as part of onboarding and on a recurring basis afterward, covering topics like phishing, social engineering, and safe handling of client information. Employees with access to sensitive systems are subject to background checks consistent with applicable law.
Incident Response
We maintain an incident response process for identifying, containing, and resolving security events, and for notifying affected clients in line with our contractual and legal obligations. Our security monitoring runs continuously to help identify and escalate potential security issues as they arise.
Third-Party and Vendor Management
Where we rely on third-party vendors or subprocessors to help deliver our services, we evaluate security considerations appropriate to the systems and data involved and establish applicable security requirements.

Have Questions About ITS Security?

Contact our team if you have questions about our security practices, services, or available documentation.