Information Security Policy

1. Purpose and scope

This policy establishes how Azterion Technologies ("Azterion") protects the confidentiality, integrity and availability of its own and its clients' information when providing software development, automation, websites and digital marketing services. It applies to the entire team, to projects and to the infrastructure used to deliver them, and is aligned with the principles of ISO/IEC 27001.

2. Protection of client information

Each client's information (data, credentials, code, documentation and business data) is treated as confidential by contract, used exclusively for the project that motivates it, and accessible only to the team assigned to that project. We sign non-disclosure agreements when the client requires them.

3. Access control

• Least-privilege access: each person accesses only what their role requires.
• Multi-factor authentication enabled on services that support it.
• Credentials and access keys are managed in protected configuration — never written into source code or shared through insecure channels.
• Access is revoked when a project or employment relationship ends.

4. Secure development

• Separation of development, testing and production environments.
• Backups before any change to production systems, with verified restore capability.
• Code review and input validation following recognized good practice, including the OWASP catalog.
• Responsible use of AI tools: AI-assisted code is reviewed under engineering supervision before reaching production.
• Real personal data is avoided in testing whenever it can be substituted.

5. Infrastructure and vendors

Services rely on established providers (hosting, Google, Microsoft) selected also for their security practices. Communications with the sites and systems we operate are encrypted in transit using TLS. We evaluate vendors that process client information and limit what is shared to the minimum necessary.

6. Backups and continuity

We keep periodic backups of the systems and sites under our administration, plus pre-change copies before relevant modifications, so that an incident or error can be reverted with minimal loss.

7. Incident management

Any security incident or suspected incident must be reported immediately to hello@azterion.com. Azterion contains the incident, assesses its scope, notifies affected clients without undue delay and documents corrective measures to prevent recurrence.

8. Compliance

We comply with legal, regulatory and contractual requirements applicable to information security, including Mexican data protection law (see our Privacy Policy) and the specific commitments agreed with each client.

9. Responsibilities and training

Azterion management is responsible for maintaining, communicating and enforcing this policy. The entire team knows and applies it as part of daily work and receives security guidance appropriate to each role.

10. Review

This policy is reviewed at least once a year, or earlier if operations, technology or applicable requirements change.