Cleverbox Information Security Policy

Version Date 01/01/2026

INFORMATION SECURITY POLICY Technical and organisational security measures Cleverbox takes the privacy and security of all our clients and their personal information very seriously and ensures every reasonable measure and precaution is taken to protect and secure the data that we process. We have robust information security policies and procedures in place to protect personal information from unauthorised access, alteration, disclosure or destruction and have several layers of security measures in place to secure our IT infrastructure and the data stored within.

Cleverbox will ensure that the following measures are taken with respect to the collection, holding, and processing of personal data.

Organisational Measures ●​ We regularly evaluate and review our methods of collecting, holding, and processing personal data. ●​ We regularly evaluate and review employees, contractors and other parties working on our behalf who handle personal data. ●​ We ensure any third parties we engage the services of are bound by the principles of this Policy and the GDPR and that any of their employees who may be involved in the processing of personal data are held to the same standards and conditions. ●​ Before we implement any new or change any existing personal data systems or processes, we will undergo any necessary Data Protection Impact Assessments and alert any affected Data Controllers for whom we process data on their behalf. ●​ Where any contractor or other party working on behalf of Cleverbox who handles personal data fails in their obligations under this Policy that party shall indemnify and hold harmless Cleverbox against any costs, liability, damages, loss, claims or proceedings which may arise out of their failure.

Personnel Security All employees, contractors or other parties working on behalf of the company: ●​ Undergo appropriate recruitment checks. ●​ Receive appropriate training on Information Governance and Data Protection relevant to their job role. ●​ Are made fully aware of both their individual responsibilities and the Company’s responsibilities under the UK GDPR and under this Policy, and will be bound to these principles by contract. ●​ Understand the importance of the physical security of our premises and not allow unauthorised individuals access to our offices or secure areas. ●​ Comply with our secure password policy. ●​ Exercise care, caution, and discretion while working remotely and handling, discussing or using a device with access to, any company-held personal data (i.e. ensuring information cannot be overlooked and devices are not left unattended).

Use of Personal Data Cleverbox will ensure that all employees, contractors or other parties working on behalf of the company will: ●​ Handle personal data with care at all times, not leave potentially sensitive data on desks in plain view and ensure computer screens used to view or access personal data are locked when unattended. ●​ Only have access to the personal data necessary for them to carry out their contractual obligations or job roles.

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk

●​ Not share or transfer personal data with another employee, contractor or other party that does not already have permission to access this data, without a formal request authorised by a director and an appropriate data protection agreement in place. ●​ Ensure data is accurately recorded and/or rectified as necessary. ●​ Delete and dispose of any data that is no longer needed in a secure way. ●​ Ensure that the appropriate consent has been obtained before using data for marketing purposes and that no data subjects have opted out, whether directly or via a third party service.

Transfer of Personal Data and Communications ●​ We will only share or transfer data when absolutely necessary and consider the relevant security issues for transferring data in person, by post, by email or by other encrypted cloud-based data transfer services to protect data from being intercepted, lost or disclosed to unauthorised parties. ●​ When protection is required, emails containing personal data will be marked as confidential and sent via secure networks. ●​ Personal data contained in emails, whether sent or received, will be deleted when the information contained in them is no longer required. ●​ Where personal data is to be transferred physically, either in a hard copy format or on a removable electronic media, it should be passed directly to the recipient whenever possible and sent in an appropriate container marked as confidential. ●​ The use of removable electronic media for the transfer of personal data will be kept to a minimum and only used when absolutely necessary.

Storage of Personal Data ●​ All electronic copies of personal data are to be stored securely and, when necessary, with passwords and/or data encryption. ●​ Personal data should only be stored on Cleverbox approved secure systems that are backed up and when required, encrypted. No company data is held on local systems and is accessed through the on-premise Server. ●​ Personal data may only be transferred to devices belonging to employees, contractors, or other parties working on behalf of Cleverbox when it is necessary to do so and when the party in question is bound by the principles of this Policy and the UK GDPR. ●​ Any physical copies of personal data, either in a hard copy format or on a removable electronic media, are to be stored securely in a locked box, drawer, cabinet, or similar.

Password / User Privileges Security ●​ Passwords used to access or protect personal data must conform to the following standards: ○​ A minimum of 8 characters in length ○​ Differs from the associated username ○​ Contains no more than two identical characters in a row ○​ Is not a dictionary word ○​ Includes a mixture of numeric and alpha characters ○​ Has not been reused within 6 months ○​ Has not been used for another account. ●​ Passwords will be changed regularly and will not be written down or shared inappropriately. ●​ Users access company data using a unique privilege access level username and strong password. ●​ Employees will only have access to the personal data necessary for them to fulfil their job role. ●​ All user accounts are configured to require a password change on a regular basis. ●​ Inactive accounts are removed/revoked as and when they are no longer required.

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk

●​ Users are informed to never share or tell anyone their passwords and are assured that they will never be reprimanded for refusing or challenging anything they believe is contrary to company security policies.

IT Security Cleverbox Internal Systems and Software Security Cleverbox employs full end to end control over the security and management of the company data. We run a full Mac OS X system environment, therefore all wording and policies set out are specific to this platform and its infrastructure. ●​ Software (including, but not limited to, applications and operating systems) will be kept up-to-date; no software will be installed on a Cleverbox owned computer or device without undergoing a review and only with the consent of a company director. ●​ MacOS provides a feature called Gatekeeper. Gatekeeper allows system administrators to set a required security level for installing applications to control the sources from which apps can be installed. Cleverbox enforces the most secure Gatekeeper setting, meaning that only applications with a valid Apple Developer Signature ID can be installed on our systems. ●​ Devices (either owned by Cleverbox or personal devices used to access company personal data) will be logged and have the appropriate device settings activated, when necessary, so that any data from lost or stolen devices can be remotely deleted. ●​ Systems are administered and set up using an administrator accessible controlled account. This allows for a secure account provisioning approval process which limits standard users privileges, allows for account deletion when not required and provides the minimum level of access required to standard user accounts. System passwords are changed on a regular basis. ●​ Each user must authenticate using a unique username and secure password at each system login in order to obtain access to system applications and network devices. All systems auto logout after 5 minutes of system inactivity. ●​ MacOSX System update policy is strictly implemented and regular updates are applied when available.

We also regularly check for out of date software and remove when no longer supported. All security patches / updates are applied within 30 days of release from vendors. ●​ As well as the embedded Apple anti-malware protection, Cleverbox run Symantec Endpoint Protection for Mac on all systems. This provides real-time protection against existing and emerging malware including ransomware and viruses. ●​ We use Office 365 for our email system and benefit from industry standard security and backup storage.

On Premises Server and Backup Security ●​ Servers are configured and managed securely to minimise levels of inherent vulnerabilities. ●​ Servers are configured in such a way to provide only the services to each employee required to fulfil their role, enabling Cleverbox to protect company data and integrate within a secure enterprise networking environment. ●​ All system critical update policies are adhered to fully to ensure timescales for applying updates and patches are monitored and applied within the required timeframe ensuring best security practice at all times. ●​ All personal or business sensitive data is held in a fully secure environment and access enabled solely to those who require it. This process provisions strict access policies to all company held data, ensuring users have access only to required company held data. ●​ All server data on premises is stored in an enclosed and locked room and key access to this area is strictly monitored. Keys are returned as soon as individuals have finished using the room. ●​ Servers cannot be accessed from outside the internal network.

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk

●​ All data and server access again within this secure area is password restricted in order for best IT security policies to be met. ●​ All required data is backed up on premise and stored in a secure area with restricted access. ●​ Cleverbox adheres to strict company password policies using OSX Server, these policies in turn provide secure and required access privileges to the company data. ●​ User activity is monitored through access and audit logs. ●​ All backups are monitored and fault logs enabled and regularly checked. ●​ As well as on premise backup, all required data is backed up to secure and UK GDPR compliant servers within the UK and EU only, using full End to End encryption and security tunneling. ●​ We comply fully with best practice retention policies across all backups.

Network Security (Firewalls and Internet Gateways) ●​ All system firewalls and internet gateways use non-default secure admin passwords. ●​ Where applicable we enforce multiple admin logins so that each admin can use their own password in order to audit and manage system logs effectively. ●​ Admin access is made available only to those who require it. ●​ All remote management features are fully disabled, and we regularly monitor for suspicious activity. ●​ All system hardware and software within the company’s internal network is fully protected against unauthorised access and disclosure from the internet through the use of company controlled firewalls and internet gateways. ●​ All firewall and internet gateway firmware is fully monitored and applied where applicable. ●​ All non-required network protocols are fully disabled, only those actually required are enabled. ●​ Firewall rules no longer required are removed. ●​ Company controlled firewall and internet gateways: real time clocks are set correctly and set to refresh with a reliable and trusted NTP server (public time server) in order that logs are accurate and that all scheduled events take place at the intended time. ●​ Wireless LAN: we ensure that we use the strongest wireless encryption available and enforce an automatic schedule to disable wireless LAN access outside of office hours. An isolated guest network is also in place which isolates guests from the company’s private wireless traffic and the company network. WLAN passwords are also changed on a regular basis. ●​ We enforce a company AUP (acceptable usage policy), so that staff know what is permitted on the company network and what best practices are expected of them.

Client Website Servers and Backup Security For Client Proprietary CMS Sites: Our proprietary CMS websites are hosted by Amazon Web Services (AWS). Cleverbox utilises a wide variety of AWS services and features to deliver a fast, secure and resilient cloud based service to our clients. This complex and scalable infrastructure is monitored 24/7 by our dedicated server support team. More information about the standard AWS SLA can be found here: https://aws.amazon.com/compute/sla/ Our servers include the following specification: ●​ ●​ ●​ ●​ ●​ ●​ ●​ ●​ ●​

Red Hat Enterprise Linux software SSD storage on SAN based hardware Multi core Intel Xeon 2 CPUs Built in software DOS protection AWS EC2 and RDS separate web server and database instances Industry leading CDN technology powered by AWS S3 and CloudFront Latest version of Apache, PHP and anti virus XSS and SQL injection prevention Daily and weekly backups

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk

Development Environment The servers used to store backups of our clients’ websites are protected by the following measures: ●​ ●​ ●​ ●​

Servers are kept in a locked room with access limited to two key holders.

Access is monitored and recorded with keys signed out with name, date, time and signature.

Keys are returned as soon as individuals have finished using the room.

Both physical and digital access is granted to only those individuals who require it and who are bound by the data protection principles set out in this policy. ●​ Servers cannot be accessed from outside the internal network.

For Client Wordpress Sites: The websites that Cleverbox provides utilising Wordpress are hosted through CloudNext to deliver dedicated, fast, secure and reliable service with no single point of failure. They offer cutting-edge hosting technology and is an industry leading hosting platform with 99.99% uptime. ​ ​ The hosting platform includes the following: ●​ ●​ ●​ ●​ ●​ ●​ ●​ ●​ ●​ ●​

WordPress specific, PCI-DSS compliant, cloud hosting Load Balancing Auto scaling to meet traffic demand SSD storage DDoS Protection Web Application Firewall (XSS and SQL injection prevention) Automatic malware scanning IP Address blocking Brute force login protection Daily backups (for the last 30 day period)

Cleverbox, 33 London Road, Bromley, Kent BR1 1DG T: 0208 466 7222 team@cleverbox.co.uk www.cleverbox.co.uk