Security Policies & Practices

Cloud Security Configurations

Password Policies

• Default passwords must be updated immediately during initial configuration
• Minimum length of 12 characters with uppercase, lowercase, numbers, and special characters
• Passwords generated and stored using secure password manager (1Password)

Data Transmission Protocols

• HTTP replaced with HTTPS on all web-based services
• TLS termination enabled at the Cloudflare edge and cluster load balancers
• Always Use HTTPS enforced across all services via Cloudflare
• WPA2/WPA3 encryption required for all wireless communications

Logging and Monitoring

• AWS CloudWatch for logging metrics, events, and alarms
• SigNoz and Grafana (OpenTelemetry) for application metrics, traces, and diagnostic logs
• Cloudflare Logs for DNS queries, firewall events, and HTTP requests
• Logs retained for minimum 365 days; critical logs retained for 2 years

Daily Automated Backups

• Cloud hosting providers perform automated daily backups of essential data
• Backups maintained for up to 7 days for quick recovery
• Backups stored separately from servers in cloud-based file storage
• Access restricted to Admin role only

Annual Manual Backup

• Annual manual backup of business-critical data
• Stored on password-protected encrypted USB in separate office location
• Non-business-critical data (Google Drive, Notion) backed up annually

Backup Testing

• Restoration process tested at least twice per year
• Ensures backups are functional and capable of restoring data in timely manner
• Role-based access control for backup management

Cloud Shared Responsibility Model

Cloud hosting providers (Hetzner, AWS, Cloudflare) maintain infrastructure availability including automatic backup services. Voltade ensures data backup, encryption, and security configurations are correctly applied.

Unauthorised & EOS Assets

• All unauthorised or EOS assets identified, removed, and replaced with supported versions
• Continued use of EOS assets requires risk assessment and written management approval
• Enhanced security controls applied until replacement is possible

New Asset Onboarding

• All new hardware and software undergo authorization process
• Written approvals required via email or Telegram from Management
• Assets sourced only from official or trusted sources
• Malware scans conducted on all new assets before deployment

Secure Asset Disposal

• Data Deletion: Hard disk encrypted before reformatting; disk overwritten to prevent recovery
• Physical Destruction: Hard disks physically destroyed or shredded via certified services
• Documentation: Secure disposal report maintained with method details and data erasure confirmation

Regular Audits

Quarterly audits conducted focusing on unauthorised/EOS asset management, secure disposal records, and compliance with internal and external cybersecurity policies.

Default Retention Periods

AI Training Data

Secure Data Deletion Process

1. Data Identification: All customer data objects (conversations, files, logs) mapped using internal identifiers
2. Secure Wiping: Data deleted using provider-native secure wipe mechanisms:
   • Hetzner and AWS: Block and object storage zeroed or cryptographically wiped
   • Cloudflare: Cache entries purged globally within minutes
3. Backups: Aged out within 30 days; encrypted and inaccessible until expiry
4. Confirmation: Written confirmation via email that data has been permanently removed

Technical Standards

• Deletion operations follow NIST SP 800-88r1 standards for media sanitisation
• Storage encryption (AES-256 at rest) ensures expired data is inaccessible before overwrite
• All deletion events logged and auditable for compliance

Anti-Malware Requirements

• MacBooks: Built-in XProtect solution considered sufficient
• Windows: Up-to-date antivirus required (Windows Defender, McAfee, etc.)
• Servers: Hardened, minimal-footprint Linux (Talos) with no interactive shell; container images scanned before deploy
• Real-time scanning and automatic daily updates enabled
• Full-system scan conducted at least quarterly

Firewall Configuration

• Perimeter Firewall: Analyses and restricts unauthorised traffic using packet filters, DNS firewalls, and application-level gateways
• Endpoint Firewalls: Windows Defender Firewall or equivalent must remain active
• Firewall rules reviewed annually

Trusted Networks

• Corporate Wi-Fi networks configured and monitored by IT
• Personal Wi-Fi secured with WPA2/WPA3 encryption
• VPN required when working remotely on public networks
• Automatic connections to unsecured networks disabled

Session Security

• All devices automatically lock after 15 minutes of inactivity
• Database and admin portal sessions time out after 15 minutes
• Session timeout policies reviewed annually

Access Request Process

1. Employee submits written request specifying system, role, and dates
2. Management reviews for validity and alignment with policies
3. If approved, access granted and logged in Accounts Tracker
4. Password changed to strong passphrase (12+ characters) via 1Password
5. 2FA implemented for admin accounts (Google Authenticator or SMS OTP)

Access Revocation

• Access revoked when employee leaves, role changes, or access no longer needed
• Revocation processed immediately upon approval
• Dormant accounts (60+ days inactive) disabled or removed

Failed Login Protection

• After 10 failed login attempts, further attempts are throttled
• Suspected account compromise triggers immediate password change
• Access logs reviewed quarterly for unauthorised access

Administrator Access

Administrator accounts restricted to Management only, used solely for administrative functions such as organisation setup, member management, and billing.

Compliance Framework

• Singapore's Personal Data Protection Act (PDPA)
• GDPR Article 35 (where relevant for EU-based customers)
• CSA Cyber Essentials Mark
• ISO/IEC 27001 control families

Categories of Personal Data

• Identifiers: Customer names, phone numbers, email addresses
• Communications: Messages, attachments, contextual chat history
• Transactions: Quotation requests, invoices, appointments
• Staff Data: Names, contact info, internal notes

Technical Safeguards

• Encryption: TLS 1.2/1.3 in transit, AES-256 at rest
• Access Controls: MFA, least-privilege roles, just-in-time access for admins
• Audit Logging: Immutable logs with anomaly monitoring
• Spam/Scam Protection: LLM-powered auto-labelling for suspicious content

Sub-Processors with DPAs

• Hetzner Cloud – Kubernetes compute for Envoy CRM, Singapore (ISO 27001)
• Amazon Web Services (AWS) – Aurora, S3, and SES in Singapore (ap-southeast-1)
• Cloudflare – CDN, WAF, DDoS protection, and Zero Trust access
• Microsoft Azure – container registry and Entra ID sign-in only; no customer data
• OpenAI – Large Language Model API
• Signoz/Sentry – Observability and error monitoring
• Windmill – Secure automation/orchestration

Data Subject Rights

Voltade supports PDPA/GDPR-equivalent rights including access to personal data, correction of inaccuracies, deletion/erasure upon request, and objection to processing. Requests processed within 30 days.

Retrieval-Augmented Generation (RAG)

Voltade employs RAG to constrain AI responses to your knowledge base, preventing hallucination by anchoring outputs in vetted sources. This ensures the AI can only answer questions based on information you've provided.

Explainability Features

• Every AI answer cites its knowledge base sources
• Explanations simplified into plain business language for non-technical users
• Confidence scores generated for extracted data (leads, invoices)
• Advanced debug mode shows reasoning traces for developers
• GPT-5 reasoning models explain decision pathways when queried

Human-in-the-Loop Oversight

• Low-confidence results trigger automatic escalation to human operators
• AI leaves internal notes with summary, reasoning, and confidence score
• SMEs can configure escalation thresholds (e.g., "Always escalate financial data")
• All corrections and overrides logged for accountability

Bias Detection & Mitigation

• Controlled Scope: RAG constrains responses to SME's own knowledge base, reducing exposure to global biases
• Source Transparency: Citations allow SMEs to verify response basis
• Continuous Feedback: Correction patterns monitored to detect bias
• Lab Testing: Synthetic conversations surface unfair generalisations

Region-Specific Threat Awareness

AI auto-labelling protects SMEs against local threats:

• Phishing & impersonation detection
• Invoice fraud & business email compromise (BEC) flagging
• Fake promotions & package scam identification
• Multilingual evaluation (English, Mandarin, Malay, Tamil, Singlish)
• Integration with CSA advisories and ScamShield reporting

Prioritisation of Critical Updates

Critical and important updates, including security patches, are implemented within 48 hours across operating systems, application frameworks, databases and managed dependencies.

Compatibility Testing

No update is promoted to production until it has passed compatibility testing in a staging environment and cleared the automated verification gate:

• Production build must succeed
• Full TypeScript type verification across server and client
• Static analysis, repository invariant checks, and dead-code / unresolved-dependency detection
• Component test suite and integration suite executed against a real PostgreSQL instance, including database migration application
• A failure at any stage blocks the deployment entirely

Cloud Shared Responsibility

• Voltade: patches the software it manages — applications, databases and system libraries
• Cloud providers: patch the underlying hardware, network and virtualisation layers
• Visibility: AWS Security Bulletins and Security Hub, Azure Defender for Cloud, and Cloudflare advisories are monitored for patches applied on our behalf
• Requirement: providers must apply critical infrastructure patches within their published SLA and notify us of vulnerabilities affecting the services we consume

Customer Communication

Voltade is delivered as a hosted service — customers install, host and patch no Voltade software component, and carry no patch-implementation obligation. Updates are communicated as follows:

• Release notes for each material release, published at voltade.com/product-updates
• Advance notice to named administrators for any change requiring customer-side action
• Planned maintenance and service health published at status.voltade.com
• Customer obligation: keep browsers current (two most recent major versions of Chrome, Edge, Safari, Firefox) and devices set to automatic OS updates
• Customer-managed deployments: written installation and upgrade instructions supplied with the project documentation and work order

Documentation & Audit Trail

• Implementation records for every update held in version-control history
• Automatic-update logs retained in the respective cloud providers' log streams
• Cloud provider security advisories and applied patches recorded for responsibility tracking
• Records reviewed quarterly; this policy reviewed annually or on significant stack change