Information Security Policy

Introduction

This Information Security Policy outlines the principles and guidelines for ensuring the confidentiality, integrity, and availability of data and systems within Rematch. It is essential to maintain the trust of our users and protect their sensitive information. This policy serves as a foundation for our information security practices.

Information Security Objectives

2.1. Confidentiality

2.1.1. Protect user data, including personal and contact information, from unauthorized access.

2.1.2. Ensure the privacy of user interactions and communication within the app.

2.1.3. Maintain the confidentiality of any sensitive business information.

2.2. Integrity

2.2.1. Prevent unauthorized alteration or tampering of user data.

2.2.2. Ensure the accuracy and reliability of user profiles and matches.

2.3. Availability

2.3.1. Ensure the app’s uptime and accessibility to users.

2.3.2. Implement disaster recovery and backup procedures to minimize service interruptions.

User Authentication

3.1. User Authentication Policies

3.1.1. Password Complexity: Users are required to create strong and complex passwords. Passwords should include a mix of upper and lower-case letters, numbers, and special characters. Passwords should be of a minimum length and updated regularly.

3.1.2. Multi-Factor Authentication (MFA): MFA is a mandatory requirement for all user accounts. Users must configure MFA using a trusted device or application, enhancing the security of their accounts.

3.1.3. Account Lockout Policy: Implement an account lockout policy that temporarily locks out users after a specified number of unsuccessful login attempts to prevent brute-force attacks.

3.2. Password Storage and Protection

3.2.1. Secure Password Hashing: User passwords should be securely hashed and salted before storing them in the database to prevent unauthorized access in case of a data breach.

3.2.2. Password Recovery: Implement a secure and user-friendly password recovery process that does not compromise the security of user accounts. Utilize methods like email verification and secret questions.

3.3. User Account Management

3.3.1. User Registration Verification: Verify the authenticity of user registration information, such as email addresses and phone numbers, to prevent fake accounts.

3.3.2. User Profile Updates: Ensure that user account information can only be updated by the account owner or authorized personnel after thorough identity verification.

3.3.3. Account Inactivity: Implement an account inactivity policy, where accounts that remain inactive for a defined period are automatically locked or deleted.

Application Security

4.1. Secure Development

4.1.1. Conduct regular security assessments and code reviews to identify and rectify vulnerabilities.

4.1.2. Ensure that developers follow best practices for secure coding.

4.2. Security Testing

4.2.1. Regularly conduct penetration testing and vulnerability assessments.

4.2.2. Address identified vulnerabilities promptly.

4.3. Third-party Security

4.3.1. Assess and monitor third-party services used within the app for security vulnerabilities.

4.3.2. Review third-party contracts for data protection and security clauses.

4.4. User Account Management and Fraud Prevention

4.4.1. User Registration Verification: Require users to verify their email addresses and phone numbers during the registration process. This helps ensure that each account is associated with legitimate and unique contact information.

4.4.2. Identity Verification: Implement identity verification procedures, which may include requesting additional documentation or using identity verification services for high-risk accounts.

4.5. Fraud Detection and Monitoring

4.5.1. Behavioral Analysis: Implement behavior analytics to detect suspicious or abnormal user activities, such as multiple logins attempts from different locations in a short period.

4.5.2. Transaction Monitoring: Continuously monitor user transactions and activities, especially financial transactions, to identify and flag potentially fraudulent activities.

4.6. Account Locking and Suspension

4.6.1. Automated Account Locking: Automatically lock accounts that exhibit suspicious behavior, such as multiple failed login attempts or unusual account activity.

4.6.2. Manual Account Review: Assign personnel responsible for manually reviewing and assessing suspicious accounts. If fraud is confirmed, suspend or terminate the account and initiate an investigation.

4.7. Account Recovery and Resolution

4.7.1. Fraudulent Account Resolution: In cases of confirmed fraudulent activities, follow a well-defined process for addressing the situation, which may involve cooperation with law enforcement, reporting to relevant authorities, and taking legal action as necessary.

4.7.2. User Notification: Notify users whose accounts have been compromised or involved in fraudulent activities and provide guidance on how to regain control of their accounts and prevent further unauthorized access.

4.8. User Education

4.8.1. Fraud Awareness: Educate users on common fraudulent schemes, such as phishing, catfishing, and identity theft. Provide information on how to recognize and report fraudulent activities.

4.8.2. Safe Online Practices: Encourage users to adopt safe online practices and maintain awareness of their own account security.

4.9. Data Retention

4.9.1. User Data Retention: Define data retention policies specific to accounts involved in fraudulent activities. Data should be retained for investigative and legal purposes, but strict access controls must be applied to such data.

4.9.2. Data Deletion: After the necessary data retention period, ensure the secure deletion of user data to protect privacy and comply with data protection regulations.

Data Integrity

5.1. Data Validation and Sanitization

5.1.1. Input Validation: Implement rigorous input validation procedures to ensure that data entered by users is clean and free from malicious code or unintended content.

5.1.2. Data Sanitization: Sanitize user-generated content to remove or neutralize potentially harmful elements such as scripts, SQL injections, and cross-site scripting (XSS) attacks.

5.2. Data Modification Controls

5.2.1. Change Logs: Maintain comprehensive logs of data modifications, including who made the changes, when the changes occurred, and the nature of the modifications.

5.2.2. Version Control: Implement version control mechanisms for critical data to track changes and roll back to previous states if unauthorized or erroneous modifications are detected.

5.3. Data Backups

5.3.1. Regular Backups: Perform regular backups of all critical data to ensure the ability to restore data in the event of data corruption, loss, or cyberattacks.

5.3.2. Offsite Storage: Store backup data in an offsite location to protect against physical disasters and ensure data integrity is maintained even during catastrophic events.

5.4. Data Access Control

5.4.1. Role-Based Access Control: Restrict access to data based on user roles. Users should only have access to data necessary for their job functions, reducing the risk of unauthorized modifications.

5.4.2. Encryption: Employ encryption to secure data both in transit and at rest to prevent unauthorized access and modification.

5.5. Data Validation Checks

5.5.1. Data Validation Rules: Establish data validation rules and checks to verify the accuracy and completeness of data at the time of input and during data processing.

5.5.2. Integrity Verification: Implement mechanisms to verify data integrity, such as checksums or hash values, to ensure that data has not been altered during storage or transmission.

5.6. Incident Response for Data Integrity

5.6.1. Data Integrity Incidents: Define a specific incident response plan for data integrity breaches, including identification of the breach, containment, eradication, and recovery procedures.

5.6.2. Data Restoration: Ensure that in case of data integrity incidents, there are measures in place to restore the data to its last known good state.

5.7. Data Retention and Deletion

5.7.1. Data Retention Policies: Establish clear data retention policies, including a defined period for retaining data. This helps ensure that unnecessary data is not retained, reducing the risk of unintended data modifications.

5.7.2. Secure Data Deletion: Implement secure data deletion practices, which involve securely erasing or overwriting data when it is no longer needed, ensuring data integrity and user privacy.

5.8. User Accountability

5.8.1. User Training: Train employees on the importance of data integrity and their role in maintaining it. Users should be aware of their responsibilities for accurate data entry and report any data discrepancies promptly.

5.8.2. Accountability Measures: Implement measures to hold users accountable for intentional or negligent actions that compromise data integrity.

Data Encryption

6.1. Encryption of Data in Transit

6.1.1. Ensure that all data transmitted between the app and its servers is encrypted using strong encryption protocols (e.g., TLS) to prevent interception and eavesdropping.

6.1.2. Regularly update encryption protocols to align with industry best practices and address vulnerabilities.

6.2. Encryption of Data at Rest

6.2.1. All sensitive data stored on servers, including user profiles and personal information, must be encrypted at rest using strong encryption algorithms.

6.2.2. Implement encryption key management procedures to protect encryption keys and ensure their secure storage.

Vulnerability Management

7.1. Vulnerability Assessment

7.1.1. Conduct regular vulnerability assessments and scans on the app’s infrastructure, including servers and databases, to identify and remediate vulnerabilities.

7.1.2. Promptly address and patch identified vulnerabilities, following a documented process.

7.2. Patch Management

7.2.1. Maintain a patch management process that ensures timely application of security patches to all components and software used in the app’s infrastructure.

7.2.2. Apply patches in a way that minimizes disruption to service availability.

Incident Response

8.1. Incident Reporting

8.1.1. Establish a clear incident reporting procedure for all employees, contractors, and users to report security incidents and breaches.

8.1.2. Ensure that incidents are reported without fear of retribution.

8.2. Incident Response Plan

8.2.1. Develop and maintain an incident response plan that outlines procedures for identifying, responding to, containing, and recovering from security incidents.

8.2.2. Regularly test the incident response plan through simulations and drills.

8.3. Communication and Notification

8.3.1. Establish communication protocols for notifying relevant parties, including users, authorities, and affected individuals, in the event of a security breach.

8.3.2. Comply with legal and regulatory requirements regarding data breach notifications.

Physical Security

9.1. Data Center Security

9.1.1. Ensure that data centers and physical servers are located in secure, access-controlled facilities with appropriate environmental controls.

9.1.2. Implement access controls, surveillance, and monitoring to protect physical infrastructure.

9.2. Access Control

9.2.1. Enforce strict access control policies for data centers, server rooms, and other sensitive physical areas.

9.2.2. Implement biometric or card-based access systems and restrict physical access to authorized personnel only.

Employee Training and Awareness

10.1. Security Training

10.1.1. Provide security training to all employees to educate them about security best practices, policies, and procedures.

10.1.2. Offer ongoing security awareness training to keep employees informed about emerging threats and the importance of security.

Compliance and Regulation

11.1. Regulatory Compliance

11.1.1. Maintain awareness of and comply with all relevant data protection laws and regulations applicable to the app and user data.

11.1.2. Regularly review and update security policies to ensure alignment with changing legal and regulatory requirements.