Security Policy

This Security Policy ("Policy") outlines the security measures and practices implemented by FlosslyOS Ltd. ("Flossly," "we," "us," or "our") to protect the confidentiality, integrity, and availability of our AI Powered Task Manager & CRM software ("Platform") and the data processed through it.

We are committed to maintaining the highest standards of security to protect our users' information and ensure the safe operation of our Platform. This Policy describes our comprehensive security framework and ongoing security practices.

By using our Platform, you acknowledge that you have read and understood this Security Policy. We reserve the right to update this Policy as needed to reflect changes in our security practices or applicable regulations.

Security Framework

Our security framework is built on industry best practices and compliance standards, including:

ISO 27001 Information Security Management System
GDPR and UK Data Protection Act 2018 compliance
NIST Cybersecurity Framework alignment
Healthcare industry security standards (for medical data)
Regular third-party security assessments

Data Encryption

We implement multiple layers of encryption to protect your data:

Data in Transit: TLS 1.3 encryption for all data transmission
Data at Rest: AES-256 encryption for stored data
Database Encryption: Transparent Data Encryption (TDE) for databases
File Storage: Encrypted file storage with secure key management
Backup Encryption: All backups are encrypted before storage

Access Controls and Authentication

We maintain strict access controls to ensure only authorised personnel can access your data:

Multi-factor authentication (MFA) for all user accounts
Role-based access control (RBAC) with principle of least privilege
Regular access reviews and privilege audits
Strong password policies and regular password updates
Session management with automatic timeout
IP whitelisting for administrative access

Infrastructure Security

Our infrastructure is designed with security as a primary consideration:

Secure cloud hosting with enterprise-grade security
Network segmentation and firewall protection
Intrusion detection and prevention systems (IDS/IPS)
Regular security patching and updates
DDoS protection and traffic filtering
Secure configuration management

Application Security

Our Platform is developed and maintained with security best practices:

Secure coding practices and regular code reviews
Automated security testing in CI/CD pipeline
Regular penetration testing and vulnerability assessments
Input validation and output encoding
SQL injection and XSS prevention measures
API security with rate limiting and authentication

Data Protection and Privacy

We implement comprehensive data protection measures:

Data minimisation and purpose limitation
Pseudonymization and anonymization where appropriate
Data retention policies and secure deletion
Cross-border data transfer safeguards
Regular data protection impact assessments
Privacy by design and default principles

Incident Response

We maintain a comprehensive incident response plan:

24/7 security monitoring and alerting
Dedicated incident response team
Automated threat detection and response
Regular incident response drills and training
Communication protocols for security incidents
Post-incident analysis and improvement processes

Employee Security

Our team is trained and committed to maintaining security:

Background checks for all employees
Regular security awareness training
Confidentiality agreements and security policies
Secure development training for technical staff
Incident reporting procedures
Regular security policy updates and communication

Third-Party Security

We ensure our partners and vendors maintain high security standards:

Vendor security assessments and due diligence
Data processing agreements with security requirements
Regular vendor security reviews
Incident notification requirements
Compliance verification and audits
Secure integration and API management

Compliance and Auditing

We maintain compliance with relevant security standards:

Regular internal security audits
Third-party security assessments
Compliance monitoring and reporting
Security metrics and KPIs tracking
Continuous improvement processes
Regulatory compliance verification

Business Continuity

We maintain business continuity and disaster recovery capabilities:

Regular data backups with tested restoration procedures
Disaster recovery planning and testing
Redundant systems and fail-over capabilities
Business continuity planning
Service availability monitoring
Recovery time and point objectives (RTO/RPO)

Security Monitoring and Logging

We maintain comprehensive security monitoring:

Centralised logging and monitoring systems
Real-time security event analysis
Anomaly detection and behavioural analysis
Security information and event management (SIEM)
Regular log review and analysis
Threat intelligence integration

Updates and Maintenance

We regularly update our security measures to address emerging threats and maintain the highest security standards. This includes:

Regular security patch management
Security tool and technology updates
Policy and procedure reviews
Staff training updates
Threat landscape monitoring
Security architecture improvements

Reporting Security Issues

If you discover a security vulnerability or have concerns about our security practices, please report them to us immediately:

Email: helloflossly@gmail.com
Address: FlosslyOS Ltd, Flat A, 138 Alwoodley Lane, Leeds, England, LS17 7PP

We take all security reports seriously and will investigate and respond promptly. We appreciate your help in keeping our Platform secure.

Contact Us

If you have any questions about this Security Policy or our security practices, please contact us at:

Email: helloflossly@gmail.com
Phone: 0800 689 1061
Address: FlosslyOS Ltd, Flat A, 138 Alwoodley Lane, Leeds, England, LS17 7PP