Information and Cyber Security Policy

Introduction

This page explains how Hybytes Ltd protects the information we hold, whether it belongs to our clients, our partners, or our own business. It sets out what our security programme covers and who is responsible for keeping it up to date.

1. Our commitment

Hybytes Ltd is committed to protecting the confidentiality, integrity, and availability of the information we hold. This applies equally to our clients' data, our partners' data, and our own.

2. What our security programme covers

Our security programme is risk-based. We follow recognised good practice, including Cyber Essentials and the principles of ISO/IEC 27001. It includes:

Least-privilege access control with multi-factor authentication
Encryption of data in transit and at rest
Separation of production and non-production environments
Secure development practices, including dependency and vulnerability scanning in our CI/CD pipelines
Automated backups with tested restores
Centralised logging, monitoring, and alerting
Endpoint protection and mobile device management
A documented incident response process, including notification obligations under our Data Processing Agreement
Security assessments of our suppliers
Security awareness training for all staff

3. Policy ownership and review

A company director owns this policy. We review it at least once a year, and sooner if a major incident or a change to our systems or engagements means an earlier review is needed.

4. Where to find more detail

For engagement-level detail, see our Security Overview and the technical and organisational measures set out in our Data Processing Agreement.

5. Questions

This statement summarises our internal policy and does not form part of any contract. If you have questions, please use our contact form.