Security Policy

01Overview and Scope

What this Policy covers and the basis on which it is maintained.

1.1 This Policy sets out the measures Bluto maintains to protect personal data and Customer Content processed through the platform. It covers our hosting environment, the application, our operational practices and our supply chain.

1.2 We take a risk-based approach to information security, proportionate to the sensitivity of the data we hold and the nature of the threats we face. Controls are assessed against the likelihood and potential impact of identified risks to the confidentiality, integrity and availability of data.

1.3 Our security practices are designed in alignment with recognised information security frameworks. Bluto does not currently hold ISO 27001 certification or a SOC 2 report.

1.4 This Policy is published so that Subscribers and their advisers can understand how their data is protected. Subscribers requiring further detail for their own due diligence may contact [email protected].

1.5 We review this Policy when our controls, hosting environment or processing activities change, and record updates in the change log at the foot of the page.

02Infrastructure Security

The controls applied to our hosting environment and stored data.

2.1 Hosting. The Service is hosted on Amazon Web Services infrastructure in the United Kingdom (London region). Customer Content and Subscriber account data are stored within the United Kingdom.

2.2 Physical security. We do not operate our own data centres. Physical security of the infrastructure on which the Service runs is maintained by AWS, which holds ISO 27001 and SOC 2 Type II certification for its data centre operations and is subject to independent audit.

2.3 Encryption at rest. All data at rest is encrypted using AES-256. Customer Content stored in AWS RDS databases and on EC2 instance volumes is encrypted using keys managed through AWS Key Management Service, with separation of duties and key rotation.

2.4 Encryption in transit. All connections to the Service are encrypted. TLS 1.2 is the minimum accepted at both the network edge and the origin, with virtually all traffic negotiating TLS 1.3. Encryption is enforced end to end, including the connection between our network edge provider and our origin infrastructure. Unencrypted connections are redirected rather than served.

2.5 Network controls. Our hosting environment is protected by network-level controls including firewall rules and traffic filtering at the network edge. Development, staging and production environments are logically separated.

2.6 Backups. Customer Content and account data are backed up automatically on a daily basis using AWS managed backup infrastructure. Backups are encrypted and retained for 7 days, after which they are permanently purged and data cannot be recovered from backup.

2.7 Environment separation. No Customer Content or live personal data is used in development or testing environments.

03Application Security

The controls applied to the application and to how it is built and monitored.

3.1 Access control.

3.1.1 Access to production infrastructure requires multi-factor authentication.

3.1.2 Access privileges follow the principle of least privilege. Application-level access controls enforce separation between accounts, so that data belonging to one Subscriber is not accessible from another.

3.1.3 Access to production systems is limited to authorised personnel and is revoked when it is no longer required.

3.1.4 Access to production infrastructure is logged. See clause 3.5.

3.2 Development and deployment.

3.2.1 Changes to the application are subject to automated checks before they can be deployed. A type-safety check runs on every build and blocks deployment where it fails.

3.2.2 Security considerations, including protection against the categories of vulnerability described in the OWASP Top 10, are addressed as part of the development process.

3.2.3 Dependencies are updated in response to identified security issues.

3.3 Vulnerability management. Where a vulnerability is identified in our systems or dependencies, it is assessed and prioritised according to its severity and the risk it presents to the confidentiality, integrity or availability of data, and remediated on that basis.

3.4 Security monitoring. Our AWS infrastructure is continuously monitored for configuration and compliance issues using a cloud security posture management tool. Findings are reviewed and remediated in accordance with clause 3.3.

3.5 Logging and alerting.

3.5.1 Access to production infrastructure and changes to its configuration are recorded in an audit trail which is retained indefinitely. Operational and application logs are retained for shorter periods appropriate to their purpose.

3.5.2 Automated alerting is configured across the production environment. Alarms monitor database connection health, email delivery failures and bounce rates, and the queue used for inbound document processing. Alerts are delivered to a monitored channel with delivery confirmation.

3.5.3 Where an alert indicates a potential security issue, it is investigated in accordance with section 05.

3.6 Periodic security testing is carried out across the platform. Findings are remediated in accordance with clause 3.3.

04Operational Security

How we manage suppliers, changes and continuity.

4.1 Supplier security. We assess third-party providers before engaging them to process personal data on our behalf, and require them to maintain security measures appropriate to the data concerned. All such providers are engaged under data processing agreements in accordance with clause 4 of our Data Processing Agreement. The providers we engage are listed at bluto.ai/legal/subprocessors.

4.2 Providers processing Customer Content -- including AI providers -- are assessed for their data handling commitments before engagement, and material changes are monitored.

4.3 Change management. Changes to production systems are assessed for security impact before deployment, and are subject to the automated controls described in clause 3.2.1.

4.4 Continuity. Customer Content and account data are backed up daily as described in clause 2.6. Our infrastructure configuration is reproducible, so that the Service can be rebuilt in the event of a significant failure.

05Incident Response

How we detect, respond to and communicate security incidents.

5.1 Detection. Our production environment is monitored continuously. Alerts indicating unauthorised access, configuration change, service failure or anomalous activity are raised automatically and reviewed.

5.2 Assessment. Where a potential incident is identified, we assess its nature, scope and likely impact, including whether it constitutes a personal data breach as defined in our Data Processing Agreement.

5.3 Response. On confirming an incident we act to contain it, prevent further harm and begin remediation. Relevant logs and evidence are preserved throughout. Following a significant incident we identify the cause and address it.

5.4 Notification.

5.4.1 Where an incident constitutes a personal data breach likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, as required by the UK General Data Protection Regulation.

5.4.2 We will notify affected Subscribers without undue delay where an incident is likely to result in a high risk to their rights and freedoms, and will assist them in meeting their own notification obligations. Our obligations to Subscribers are set out in clauses 3.8 and 3.9 of the Data Processing Agreement at bluto.ai/legal/dpa.

5.5 Vulnerability disclosure. If you identify a security vulnerability in the Service, please report it to [email protected] before disclosing it publicly. We will acknowledge your report within two business days and keep you informed of remediation. We will not pursue legal action against anyone who reports a vulnerability responsibly and in good faith.

5.6 Contact. For security queries, incident reports and vulnerability disclosure, contact [email protected]. For data protection queries relating to a security incident, contact [email protected].