Policies
Policies we have in place, for your VRM department to review.
Preliminaries
The COO is the acting security officer and facilitates and maintains these policies with the team. Proposed changes are reviewed and approved by the CEO.
Need clarification on one of our policies? Missing something specific? Have a suggestion? As with our EULA, we consider our policies a living document - everything is up for debate, as long as everybody benefits. Reach out to policies@hedge.video.
Asset Management
All physical assets owned, managed, and under the control of Hedge are tracked in a detailed asset inventory through their lifecycle from initial acquisition to its final disposal.
The inventory is maintained under the supervision of the COO.
Physical assets are made available to employees only on a need-to-use base.
Assets with the capability to store data are always encrypted. Encryption keys are made available on the principle of least privilege, and access to them is managed in a password manager.
No customer data is stored on internal cloud storage unless made available by the customer for the purpose of internal testing.
Access Control Policy
Although Hedge has an office (”HQ”) at Jaarbeursplein 22, Utrecht, Netherlands, Hedge is a fully-remote, international team with a remote high-performance cloud-based infrastructure. As such, there is no vital on-premise infrastructure (pool table excluded).
Physical access to Hedge’s HQ is managed by the COO.
Employees located in the Netherlands are allowed independent access to Hedge’s HQ in Utrecht only if both CEO and COO agree with the necessity.
Digital access to any system owned or operated by Hedge is managed through an SSO user store combined with password management and secret management, both following the principle of least privilege.
All digital assets live on encrypted cloud storage and are made available to employees on a need-to-use base.
Business Continuity, Incident Management, and Disaster Recovery
As Hedge is a remote-first company, no unavailability of physical assets poses a risk for business continuity.
In the event of a disaster where hardware is rendered inaccessible or unusable, the team is prepared and equipped to continue with business with existing local IT resources supplied to each Team Member and an available connection to the public Internet, anywhere in the world.
To ensure continuity of operations, the operations Team Leads and C-suite members are equipped with physical digital access keys and instructed on recovery procedures.
To ensure the safety of the C-suite, its members are equipped with specific gear to ensure discoverability in case of an emergency.
To ensure the security and continuity of our cloud services, we employ third-party services to support our in-house team.
All third-party platforms we use are backed up, and documented on how to restore them in case of force majeure or disaster recovery.
The security officer acts as Incident Coordinator, coordinates and manages incoming incidents using a playbook, following the four-eyes principle.
Information Security
We operate under the principle of least privilege: employees are assigned the lowest level of access that allows them to do their work. All employees sign an NDA prior to getting access to any company system, asset, or credential.
Multi-factor authentication is enforced in all sensitive systems.
All employees are required to use the provided password manager to generate and store strong passwords that are never reused for other accounts. No other password managers are allowed.
Computer logins are personal, and recovery keys are stored in a password manager.
All computer systems have encrypted local hard drives, endpoint security, antivirus, malware detection, and screen locking for device security. This is enforced through security monitoring software. Remote wipe is enabled, if possible.
External storage is only allowed for test data used solely for testing products developed by the company itself, and only when used encrypted. No company data may ever be stored on external storage. External storage is subject to the Asset Management policy.
Access to cloud systems is always through a VPN.
Non-VPN remote access tools are always end-to-end encrypted.
Access to application admin functionalities is restricted to a small subset of Hedge employees.
We never store customer data on local devices like laptops.
Customer-facing systems’ logs are permanently deleted after 14 days.
Detection of incidents, loss of assets or devices, and related events must immediately be reported to the security officer.
Data Classification, Protection, and Deletion
All internal data is declared Confidential. A subset of this data is Restricted, and only accessible by C-suite members.
Internal email is not allowed, as it’s not deemed secure. Internal communication shall only use encrypted services like Slack and Zoom.
All outgoing company communication, including email, is considered to be Public. This does not mean all email is published - just that when writing an email, one should consider it to be published by a third party.
All connections to company systems are encrypted, and accessible only through MFA and VPN or vetted third-party tools.
Network access is managed through secured tokens, available to select employees, and issued on a personal encryption basis in person by the security officer. All internal network traffic is managed through a VPN, and no staging environments are accessible without VPN access.
Data at rest is always encrypted.
No internal data is ever to be accessed by non-Hedge employees without an NDA in place.
In case a file or document needs sharing with non-employees, its contents are first to be reviewed by the security officer. If deemed shareable, it’s considered Public and shared through an in-house developed product. Access is time-limited and automatically revoked.
Privacy
Refer to https://hedge.video/privacy for our public privacy policy.
Operational Security
Our software infrastructure is updated regularly with the latest security patches.
We use automatic security vulnerability detection tools to alert us when our dependencies have known security issues. We are aggressive about applying patches and deploying quickly.
Our products run on servers and clusters which are locked down with firewalls and carefully monitored, not only by employees but also by third-party services we contract for monitoring and management.
If a security update requires a native client to be updated too, such updates are mandatory. Older versions are blocked and cannot be used from that moment on.
We use several tools and services to automatically monitor uptime and site availability. Key employees receive automatic email and SMS notifications in the case of downtime or emergencies.
Backups
All customer data is stored on multiple disk arrays, provided by our cloud providers. Data is snapshotted continuously, backed up daily, and backups are stored in a separate off-site location.
Internal data is automatically backed up and stored offsite and offline, on encrypted storage.
For object storage, we rely on backup technology provided by the object storage providers themselves.
Software Development
All code changes are tested in a staging environment before deploying to production.
All software developed at Hedge undergoes a strict multi-phase development cycle, with multiple layers of test, review, and approval.
Code signing is supervised by the security officer, and managed by the Team Leads.
Last updated