Security & Compliance

1. INTRODUCTION AND SCOPE

1.1 Purpose and Scope

This Security Policy generally outlines our approach to information security and describes the technical, administrative, and physical safeguards we implement to protect customer data and maintain the security of our Service. This Policy applies to all aspects of our Service, including our web application, APIs, infrastructure, and operational processes.

1.2 Relationship to Other Policies

This Security Policy complements and should be read in conjunction with:

• Our Privacy Policy, which describes how we collect, use, and protect personal information
• Our Terms of Service, which establish the legal framework for use of our Service
• Our Data Processing Agreements, which govern our relationships with third-party processors

Where this Security Policy addresses technical security measures, the Privacy Policy focuses on data protection practices and privacy rights, while the Terms of Service establish contractual obligations and limitations of liability.

1.3 Company Information

Beacon is operated by:

2. SECURITY PRINCIPLES AND COMMITMENT

2.1 Core Security Principles

Our security program is built upon fundamental principles that guide all security decisions and implementations:

2.2 Security Commitment

Beacon is committed to maintaining robust security controls appropriate for a SaaS platform handling accessibility testing data. We recognize that security is not a destination but an ongoing journey requiring constant vigilance, adaptation, and improvement. Our commitment includes:

• Regular security assessments and updates
• Prompt response to security incidents and vulnerabilities
• Investment in security tools and training
• Alignment with industry standards and best practices
• Transparent communication about security matters affecting our customers

3. INFRASTRUCTURE/ENCRYPTION SECURITY

3.1 Hosting Infrastructure

Our Service infrastructure is hosted on enterprise-grade cloud platforms with robust physical and environmental security controls.

3.2 Encryption in Transit/Rest

All data transmitted between clients and our Service is encrypted using industry-standard protocols. Data stored within our systems is protected using strong encryption.

3.3 Cryptographic Standards

We implement cryptographic controls in accordance with industry standards:

• NIST Guidelines: Following NIST SP 800-series publications
• OWASP Recommendations: Implementing OWASP cryptographic storage cheat sheet
• Regular Updates: Monitoring for cryptographic vulnerabilities and updating as needed

3.4 Third-Party Access

Vendor Access Management: No standing third-party access to production systems. Temporary access is granted only when necessary and sessions are supervised. We maintain a full audit trail of third-party activities and require non-disclosure agreements.

4. SECURITY MONITORING

4.1 Security Monitoring

Real-Time Monitoring: Continuous monitoring of system health and security events incorporating automated alerts for suspicious activities. We conduct performance monitoring to detect anomalies and network traffic analysis for threat detection.

5. DATA BREACH NOTIFICATION

5.1 Data Breach Notification

Notification Timeline: We will notify you as soon as practical and/or legally required.

Notification Methods: Emails will be sent to affected users' registered addresses, and we may also provide in-application notifications, a website security notice, or we may mail you if required.

6. SECURITY CONTACT INFORMATION

6.1 Security Reporting

Primary Security Contact: Should you experience a non-emergent cyber incident while utilizing our Platform, please email: security@beaconaccessibility.com, and include "URGENT" in the subject line. If you do not receive a response within 24 hours, please email support@beaconaccessibility.com.

Emergency Response: For active security incidents affecting multiple customers, we maintain 24/7 on-call procedures with defined escalation paths and response teams.

6.2 Vulnerability Disclosure

Responsible Disclosure: Should you discover a vulnerability with our Platform in accordance with ethical practices, please email to coordinate security@beaconaccessibility.com before making any disclosure regarding the same.

6.3 General Inquiries

Security Questions: Email: support@beaconaccessibility.com and include "Security Question" in subject line.

Mailing Address: Maveda LLC, Attn: Security Team, P.O. Box 3267, Bloomington, IN 47401, United States.

7. POLICY UPDATES

7.1 Update Procedures

Policy Review: This Policy is reviewed annually, at a minimum.

7.2 Notification of Changes

Customer Notification: Customers are provided a 30-day advance notice for material changes via Email notification to registered addresses and/or in-application notifications and/or Website posting of updated policy.

Material Changes Include: Significant changes to security controls, new data processing locations, changes to encryption standards, and modifications to incident response procedures.

7.3 Policy Acceptance

Acceptance Requirements: Continued use of our Service constitutes acceptance of any and all Policy changes.

8. LIMITATIONS AND DISCLAIMERS

8.1 Security Limitations

No Absolute Security: While we implement comprehensive security measures, no system can be absolutely secure. We cannot guarantee that unauthorized third parties will never be able to defeat our security measures or use information for improper purposes. Users acknowledge this inherent limitation of digital security.

Evolving Threat Landscape: Security threats continuously evolve, and we adapt our defenses accordingly. However, there may be periods where new threats emerge before countermeasures can be implemented. We commit to responding promptly to new threats as they are identified.

8.2 Third-Party Limitations

Provider Security: While we carefully select security-conscious providers, we cannot guarantee their security measures. Provider security incidents may affect our Service despite our best efforts.

Integration Security: Third-party integrations may have different security standards. Users should evaluate the security of any integrations they enable and understand the associated risks.