1. Scope

This policy covers the production systems, infrastructure, and personnel involved in delivering the Algoma platform (the "Services"), including the storage, processing, and transmission of Customer Data. It does not extend to third-party websites or services that are linked from the platform but not operated by Algoma.

2. Infrastructure & Hosting

Algoma's production environment runs on established public cloud infrastructure — currently Google Cloud Platform. Algoma does not operate its own physical data centers, and instead relies on its cloud providers' physical and environmental controls, including restricted facility access, surveillance, and redundant power and connectivity.

Production environments are logically separated from development and staging environments, with independently controlled access to each.

3. Encryption

Data in transit between a customer's browser and the Services is encrypted using TLS. Data at rest — including databases, object storage, and backups — is encrypted using our cloud providers' managed encryption services. Encryption keys are managed through the cloud provider's key management infrastructure and are not accessible to Algoma personnel in plaintext form.

4. Access Control & Authentication

Access to production systems and Customer Data is limited to Algoma personnel who need it to do their job, granted individually under a named account rather than a shared credential. Access is reviewed periodically and revoked promptly on role change or termination. Administrative access to infrastructure requires multi-factor authentication.

Within the platform itself, each customer organization controls its own users, roles, and permissions. Algoma personnel can also modify users, roles, and permissions for a given organization.

5. Application Security

Algoma follows a documented development lifecycle that includes peer code review before changes reach production, and automated scanning of the codebase and its dependencies for known vulnerabilities. Security-relevant changes receive additional review, and vulnerability patches are applied on a risk-prioritized basis.

6. Network & Monitoring

Production networks are segmented, with inbound access restricted through firewalls and cloud-provider security groups. Administrative interfaces are not exposed to the public internet without authentication. Algoma logs security-relevant events — authentication, administrative actions, and system errors — and monitors for anomalous activity.

7. Data Isolation

Algoma is a multi-tenant platform. Customer Data is logically segregated at the application and database layer so that one customer organization cannot reach another's data through the Services. The access controls in Section 4 apply equally within each tenant.

8. Subprocessors

Algoma uses a limited number of subprocessors to help deliver the Services — for example, cloud hosting and email-delivery providers. Before engaging a new subprocessor that will handle Customer Data, Algoma reviews its security and privacy practices and puts a written agreement in place requiring appropriate protection of that data.

9. Personnel

Algoma personnel acknowledge confidentiality obligations covering Customer Data before they are given any access to it, and receive security awareness training on joining and on an ongoing basis, including how to recognize phishing and handle Customer Data appropriately.

10. Incident Response

Algoma maintains an incident response process for identifying, containing, and remediating security incidents. If Algoma confirms an incident that resulted in unauthorized access to, or acquisition of, Customer Data, Algoma will notify the affected customer without undue delay, and in any case within 72 hours of confirmation, with whatever information about the nature and scope of the incident is reasonably available at that time.

11. Continuity & Backup

Customer Data is backed up on a regular schedule, and backups are stored separately from production systems. Algoma maintains a disaster recovery plan intended to restore the Services within a reasonable period following a significant infrastructure failure.

12. Retention & Deletion

Algoma retains Customer Data for the duration of a customer's subscription, and for a limited period afterward to support account recovery and legal obligations. Following termination, and on written request, Algoma will delete or return Customer Data in accordance with the customer's agreement with Algoma, except where retention is required by law.

13. Your Responsibilities

Security is shared. As a customer, you are responsible for managing your own users' access and permissions within the platform, safeguarding your account credentials and enabling the authentication protections available to you, and telling Algoma promptly if you suspect unauthorized access to your account.

14. Changes to This Policy

Algoma may update this policy from time to time to reflect changes in its practices, technology, or applicable law. Consistent with Section 10.7 of the Terms of Service, material changes will not reduce the overall level of protection during a customer's term without notice. The date above always reflects the current policy.

15. Reporting a Concern

If you believe you've found a security vulnerability in the Algoma platform, or want to report a suspected incident, contact infosec@algoma.co. Please report responsibly and avoid accessing or modifying data that isn't yours.