Security governance
Information-security management, access control, change discipline and incident response are managed as explicit control areas.
Trust Center
Trust has to be inspectable.
Security, privacy, resilience and accountability are treated as operating layers. The centre below separates public controls, governance material and routes for responsible disclosure.
Control domains01 02 03 04 05 06
Public trust surface.
This page is deliberately specific about the kinds of controls that exist without turning a website into a substitute for audit evidence. Controlled evidence belongs in the Corporate Data Room.
Privacy & data
Data minimisation, purpose limitation, retention and subject-rights workflows are built into the governance model.
Resilience
Continuity planning, recovery practices and operational monitoring are treated as part of service design.
Third-party risk
Critical vendors and service dependencies are reviewed against security, data and continuity requirements.
Responsible disclosure
A published security contact and security.txt give researchers a clear route to report vulnerabilities.
Auditability
Evidence, ownership and dated records are favoured over undifferentiated statements of compliance.
Operating modelPrevent Detect Respond Recover
Prevent. Detect. Respond. Recover.
Least privilege and controlled change
Limit access to what a role requires, separate sensitive responsibilities and make production changes reviewable.
Monitoring and evidence
Keep security, access and operational evidence available for review instead of relying on undocumented process memory.
Incident ownership
Give security and privacy events named owners, escalation paths and documented handling.
Continuity by design
Prepare recovery priorities and operational dependencies before an outage or disruption occurs.
Responsible disclosure
A clear route when something needs attention.
Use the published security.txt route for vulnerability reporting. For privacy, governance or compliance topics, the contact router can send the enquiry to the right category without exposing sensitive information in analytics.