1. Purpose and Scope
The purpose of this Encryption Policy is to establish guidelines for the use of encryption to protect the confidentiality, integrity, and availability of Speak AI Inc.’s (“Speak AI”) sensitive data. This policy applies to all employees, contractors, and third parties who handle Speak AI’s data, whether in transit or at rest.
2. Policy Statement
Speak AI is committed to protecting its data by implementing robust encryption methods. This policy outlines the requirements for encrypting sensitive data to safeguard against unauthorized access, data breaches, and other security threats.
3. Data Classification
- Sensitive Data: Includes, but is not limited to, personal information, financial data, proprietary information, and any other data classified as sensitive by Speak AI.
- Public Data: Information that is intended for public use and does not require encryption.
4. Encryption Standards
- Data in Transit: All sensitive data transmitted over networks must be encrypted using industry-standard encryption protocols, such as TLS (Transport Layer Security) or IPsec (Internet Protocol Security).
- Data at Rest: All sensitive data stored on devices, servers, and storage systems must be encrypted using industry-standard AES encryption.
5. Encryption Key Management
- Key Generation: Encryption keys must be generated using approved algorithms and processes to ensure their strength and security.
- Key Storage: Encryption keys must be stored securely, using key management solutions that comply with industry standards. Keys must not be stored in plaintext or hardcoded into software applications.
- Key Access: Access to encryption keys must be restricted to authorized personnel only. Multi-factor authentication (MFA) should be used to access key management systems.
- Key Management: Encryption keys for stored data are managed by AWS and MongoDB Atlas key-management services. Keys are rotated immediately on suspected compromise.
6. Implementation and Usage
- Application Encryption: Developers must integrate encryption into applications handling sensitive data, ensuring that data is encrypted during processing, storage, and transmission.
- Database Encryption: Databases storing sensitive data must use encryption to protect data at rest. This includes full-database encryption or column-level encryption for specific sensitive fields.
- File and Disk Encryption: Sensitive files and disks, including backups, must be encrypted to prevent unauthorized access.
7. Compliance and Monitoring
- Monitoring and Auditing: Regular audits and monitoring will be conducted to verify compliance with this policy. Encryption practices will be reviewed to identify and address any gaps or weaknesses.
8. Incident Response
- Breach Response: In the event of a data breach involving encrypted data, the IT Security Team will assess the extent of the breach and take appropriate measures to mitigate the impact. This includes re-encrypting data, rotating keys, and notifying affected parties as required by law.
- Reporting: Any incidents involving encryption keys or encrypted data must be reported immediately to the IT Security Team.
9. Employee Training
- Awareness: Security awareness comes from ongoing security updates in recorded all-team meetings. New staff review the published security policies at onboarding.
10. Policy Review
This policy will be reviewed annually or as needed to ensure its effectiveness and alignment with industry best practices and emerging security threats. Changes to the policy will be communicated to all users.
11. Contact Information
For any inquiries or issues related to this Encryption Policy, please contact the IT Security Team at success@speakai.co.