Information Security
Public information security statement
Website: https://siriusone.com | Controller / operator: S.O. SIRIUSONE TECH LIMITED
Last updated: 29 October 2026
1. Purpose and approach
S.O. SIRIUSONE TECH LIMITED recognizes that protecting client information, personal data and business systems is central to trusted technology services. This statement describes our security objectives and approach at a high level; it is not an audit report, certification or contractual security schedule.
2. Security principles
We organize information security around confidentiality (authorized access only), integrity (preventing unauthorized change) and availability (maintaining access and recoverability appropriate to business needs). Controls should be proportionate to risks, system sensitivity and contractual obligations.
3. Governance and responsibilities
Security responsibilities should be assigned to relevant leadership, technical owners and authorized personnel. Policies, standards and procedures should be reviewed periodically and following material changes. Security requirements applicable to a client engagement are established in its governing agreement.
4. Identity, access and confidentiality
We aim to apply least-privilege and need-to-know access, appropriate identity verification, account lifecycle processes and confidentiality obligations. Elevated access should be restricted, reviewed and removed when no longer necessary.
5. Infrastructure, development and data protection
Security measures may include secure configuration, encryption in transit, appropriate encryption at rest, network controls, change management, vulnerability remediation and secure development practices, depending on the environment and the agreed service scope.
6. Monitoring and incident response
Potential events should be reported, triaged, contained and investigated under documented responsibilities. Material incidents are escalated based on risk and contractual requirements. Personal data breaches are assessed under applicable data protection laws, including GDPR notification duties.
7. Vendors and subprocessors
Security and data protection considerations are relevant when engaging technology suppliers. When vendors process personal data on our behalf, the corresponding legal and contractual safeguards should be assessed and documented. Client-specific subcontractor commitments depend on the applicable agreements.
8. Resilience and improvement
We seek to maintain proportionate backups, recovery planning and security maintenance for systems within our operational control. Security controls and processes should be adjusted as risks and business needs evolve.
9. Shared responsibilities
For work delivered in client environments, security duties depend on contractual responsibilities and system ownership. Customers retain responsibility for controls under their administration unless otherwise agreed. No general security statement supersedes a signed customer agreement or DPA.
10. Questions and reporting
For security questions or to report a suspected vulnerability affecting the corporate website, contact business@siriusone.com. Please avoid sending exploit details, credentials or sensitive personal data through unsecured channels.