Last updated: 5 June 2025

1. Security Framework

ClonePartner grounds every engagement on the CIA triad—Confidentiality, Integrity, Availability—and runs a formal risk assessment before any migration begins, mapping vulnerabilities, verifying access scopes, and selecting controls that neutralise identified risks.

2. Compliance & Certifications

• Infrastructure and processes are independently audited for SOC 2 Type II and ISO 27001.

• Migrations observe GDPR, CCPA, and HIPAA safeguards for regulated data.

• Current assurance reports are available under NDA on request to security@clonepartner.com

3. Data-Lifecycle Controls

Pre-migration
• Classify data sensitivity and confirm least-privilege API scopes.
• Enforce multi-factor authentication (MFA) and role-based access (RBAC) for the engineer assigned to the project.

In transit
• All data flows through TLS 1.2+ channels; private subnets block unauthorised ingress.

Temporary at-rest storage
• Staging data resides in an isolated MongoDB instance encrypted with AES-256.
• Only the designated engineer can reach that instance, enforced by RBAC and hardware-token MFA.

Post-migration
• Checksums confirm destination integrity.
• Staging databases auto-purge 30 days after project close—or sooner at the customer’s request.

4. Infrastructure & Access Security

• Network defence: layered firewalls, intrusion-detection sensors, and streaming logs to a tamper-proof SIEM.

• Zero-trust & Least Privilege: every internal service must re-authenticate; permissions are scoped to the minimum required.

• RBAC + MFA for every console, database, and CI/CD pipeline.

• Continuous monitoring & audits under the SOC 2 and ISO 27001 programmes, complemented by regular third-party penetration tests.

5. Incident Response & Business Continuity

• Immediate containment, forensic snapshot, and root-cause analysis upon alert.

• Customer notification within hours, followed by a full impact report and remediation timeline.

• Resilience measures: encrypted backups and automated fail-over to redundant infrastructure keep Recovery Point Objective ≤ 4 h and Recovery Time Objective ≤ 1 h.

6. Continuous Improvement

• Annual external penetration testing and quarterly security audits validate defences.

• All engineering and support staff complete yearly secure-coding and privacy training aligned with ISO 27001.

• A security risk assessment is rerun for every new integration connector before it reaches production.

7. Privacy & Data Processing

ClonePartner acts as a Data Processor under GDPR, signs Data-Processing Agreements on request, and never shares customer data with sub-processors beyond its audited cloud providers.

8. Contact

For SOC 2 or ISO 27001 reports, detailed questionnaires, or security disclosures, email security@clonepartner.com