Information Security Statement

• Information-security programme aligned with ISO/IEC 27001:2022 and mapped to SOC 2 Trust Services Criteria.
• Quarterly information-security committee chaired by the Managing Director.
• Documented Statement of Applicability covering Annex A controls.
• Named DPO, Head of IT Security, and Incident Response Manager.

• Single sign-on via Okta with MFA (FIDO2 hardware tokens for admin roles).
• Role-based access with least-privilege; joiner-mover-leaver process runs within 4 business hours.
• Break-glass accounts vaulted in 1Password Business with tamper alerts.
• Quarterly access reviews signed off by data-owner managers.

• TLS 1.2+ in transit, HSTS preload, TLS certificates via Let’s Encrypt with CAA pinning.
• AES-256 at rest for portal database and object storage; keys held in hardware-backed KMS.
• Field-level encryption of sensitive columns (portal MFA seeds, banking counterparty).
• Daily encrypted backups, cross-region, 35-day retention plus monthly snapshots for 12 months.
• Immutable audit trail (ALCOA+) retained for 5 years.

• Managed macOS and Windows 11 laptops with FileVault / BitLocker enforced.
• CrowdStrike Falcon EDR with 24/7 SOC monitoring by Ensign InfoSecurity.
• USB storage disabled; DLP monitoring on cloud drives.
• Automatic OS patching within 14 days of vendor release; critical CVEs within 72 hours.

• Segmented network with dedicated laboratory VLAN separate from corporate and guest.
• Cloudflare WAF and DDoS protection at the edge; rate-limiting for auth endpoints.
• Production hosted on Supabase (AWS ap-southeast-1) with private-VPC egress and IP allow-listing for admin.
• Colocation at Equinix HK1 / HK5 (primary) and SG1 (DR); biometric access, N+1 power.

• Code review required for every production merge; ≥ 2 approvers for portal.
• Automated SAST (Semgrep), SCA (Snyk), IaC (Checkov), and secrets scanning (gitleaks) in CI.
• Change advisory approval for schema and RLS-policy changes.
• Annual external penetration test (SEC Consult) covering portal, API, and integrations.

We welcome reports of security vulnerabilities. Please email security@als-analytical.hk using our PGP key (fingerprint 0xA1F3 4E29 6B0C 8B77 D411 E9F2 5C43 8AAB 7E10 21BD, also published at als-analytical.hk/.well-known/pgp-key.txt). We commit to a first response within 3 business days, a triage within 10 business days, and no legal action against researchers acting in good faith under our safe-harbour terms.

• Documented incident-response plan tested twice a year including a table-top exercise.
• Severity-based paging (PagerDuty) with 24×7 on-call rota.
• Regulator notification target of 72 hours for personal-data breaches (Art. 33 GDPR-aligned).
• Client notification without undue delay and within 48 hours where the incident affects that client.