This page summarises the internal policies and procedures Topify Consulting Ltd follows to operate Cyprus Connect. Full internal versions are available to customers under confidentiality on request, for example as part of an audit under the DPA. Each policy is owned by the management of Topify Consulting Ltd, reviewed at least once a year and after any significant incident or change.
1. Information security policy
We protect the confidentiality, integrity and availability of customer data using a risk-based approach designed with reference to ISO/IEC 27001:2022 and the risk-management measures of the NIS2 Directive. Risks are assessed at least yearly and whenever the Platform changes significantly.
2. Access control
- Access is granted on a need-to-know and least-privilege basis and reviewed regularly.
- Administrative access to servers uses personal SSH keys only; root password login is disabled.
- All Platform users use two-step sign-in. Accounts of people who leave are removed promptly.
3. Cryptography and key management
We use well-established algorithms (AES-256-GCM, RSA-OAEP 3072, PBKDF2-SHA256, TLS 1.2+). Customer Vault keys are generated and held by users; we do not hold them. Server secrets are kept only in protected configuration files, never in source code or messages.
4. Secure development and change management
- Changes are tested automatically end to end before release, including tests that confirm no unencrypted Vault content reaches the server.
- Dependencies are kept up to date and monitored for known vulnerabilities.
- Releases can be rolled back from a saved copy of the previous version.
5. Operations security
- Automatic installation of operating system security updates.
- Firewall, intrusion prevention (fail2ban) and rate limiting.
- Regular rootkit and integrity scans and review of security logs.
- Encrypted daily backups, kept for 14 days, with restore tests at least twice a year.
6. Incident response
- Detect and report: anyone who notices a possible incident reports it immediately to security@cyprusconnect.net.
- Contain: isolate affected systems, revoke credentials, block attacking addresses.
- Assess: establish what happened, which data and customers are affected, and the risk to individuals.
- Notify: affected customers without undue delay and within 24 hours of becoming aware of a personal data breach, so they can meet their 72-hour duty under Article 33 GDPR; the Commissioner for Personal Data Protection within 72 hours where we are controller; affected individuals where there is a high risk (Article 34 GDPR); and, where applicable, the national CSIRT or the Digital Security Authority within the deadlines set by law.
- Recover and learn: restore service, record the incident in the breach register, and fix the root cause.
7. Business continuity
We keep encrypted backups and documented procedures to rebuild the Platform on new infrastructure. Our goal is to restore service within 24 hours of a major failure, with at most 24 hours of data loss.
8. Supplier management
We choose suppliers that give sufficient guarantees of security, sign data processing terms with every sub-processor, keep the list in the DPA up to date, and give customers 30 days' notice of changes.
9. Data protection
- Records of processing activities are kept under Article 30 GDPR.
- Data protection impact assessments are carried out for new high-risk processing.
- Data subject requests are answered within one month.
- Data is kept only as long as stated in the Privacy Policy and the DPA, then deleted.
10. Vulnerability management
We accept reports through our Vulnerability Disclosure Policy, fix critical issues as a priority, and publish a contact in security.txt.
11. People
Everyone with access to customer data is bound by confidentiality and receives security and data protection training when they start and at least once a year.
Topify Consulting Ltd, registration no. HE 409159, VAT no. 10409159B, Alkyonis 1, 3087 Limassol, Cyprus. Contact: info@cyprusconnect.net. If a translation of this document differs from the English version, the English version applies.