Squaretalk AI Platform – Security and Compliance Policy

11. Security Governance

Encryption
All data is encrypted at rest and in flight. Encryption standards used (AES-256). Transport Layer Security (TLS) version 1.2 and above, ensuring secure, encrypted communications that align with current industry best practices and compliance requirements. Older and less secure versions of TLS are explicitly disabled to protect data integrity, confidentiality, and to mitigate potential vulnerabilities.

Logging & Retention
Comprehensive logging is implemented across all systems to capture authentication events, user actions, system changes, and operational metrics. Logs are stored in a centralized and secure location with access restricted to authorized personnel. Retention policies are in place to ensure logs are preserved for an appropriate duration to support auditing, security investigations, and compliance requirements. All logs are time-stamped, tamper-resistant, and monitored continuously to detect anomalies or unauthorized activities.

Policy Enforcement
Security and operational policies are enforced consistently across all systems and environments to ensure compliance with internal standards and client requirements. Access controls, data handling procedures, and development practices are governed by documented policies that are reviewed and updated regularly. Enforcement is supported through automated tools, code reviews, and infrastructure-as-code validations. Violations are logged, monitored, and addressed promptly through defined escalation and remediation processes. All employees and contractors are required to acknowledge and adhere to these policies as a condition of access.

Business Continuity and Disaster Recovery
The system is designed to ensure high availability and rapid recovery in the event of disruptions. Critical services are deployed across multiple availability zones to reduce the impact of localized failures. Automated backups are performed regularly, including hourly, daily, weekly, and monthly snapshots, with defined retention periods to support data restoration. Disaster recovery procedures are tested periodically to validate recovery time objectives (RTO) and ensure operational readiness. Monitoring and alerting systems are in place to detect incidents promptly, enabling a coordinated response to maintain service continuity and minimize downtime.

A formal Business Continuity Plan (BCP) is in place to ensure that essential operations can continue during and after a disruptive event. The plan outlines procedures for maintaining critical business functions, communication protocols, and roles and responsibilities across the organization. It includes predefined recovery strategies for various scenarios, such as infrastructure outages, data loss, or third-party service disruptions. Regular reviews and tabletop exercises are conducted to validate the plan’s effectiveness and to ensure that all key personnel are prepared to respond swiftly and effectively in the event of an incident.

Authentication and Authorization
We enforce secure authentication and role-based authorization across our platform. User sessions are managed using short-lived, signed JWT tokens following best practices. Access control is strictly role-based, ensuring that users and systems can only perform actions or access data permitted by their assigned roles. All authentication and authorization events are logged for auditing, with ongoing monitoring in place to detect anomalies or unauthorized access attempts.

Infrastructure Segregation
Our infrastructure is architected with strict segregation to protect client data and maintain system integrity. Production environments are isolated from development and testing environments using separate Virtual Private Clouds (VPCs). Access to the production environment is restricted to a small group of designated personnel and is only permitted for critical support and monitoring purposes. Customer data is logically separated, and enterprise deployments can be hosted in dedicated environments to meet specific isolation or compliance requirements. Network-level controls, firewall policies, and role-based access are enforced to prevent unauthorized access across environments.