Policies & Compliance Documents

Information Security Policy

Parent policy. Establishes the framework, objectives, roles, and the family of sub-policies for the Cadences ISMS.

Access Control Policy

Authentication, authorisation, MFA, account lifecycle, and periodic access review.

Acceptable Use Policy

Personnel rules for Company systems, devices, AI tools, source code, and data handling.

Data Classification & Handling Policy

Four classification levels, handling rules per level, and special treatment of Customer Personal Data.

Incident Management Policy

Incident definition, severity, roles, notification commitments, and post-incident review.

Risk Management Policy

Risk identification, assessment methodology (5×5), treatment options, and review cadence.

Vendor / Supplier Management Policy

Sub-processor selection, due diligence, contracting, ongoing monitoring, and termination.

Change Management Policy

Categories of change, lifecycle (proposal → CI → review → deploy → verify), emergency changes, and audit trail.

Cryptography Policy

Cryptographic standards (TLS, AES, hashing, asymmetric, RNG), key management, and rotation.

Endpoint Security Policy

Workstation and mobile-device baseline, BYOD considerations, loss/theft response, and disposal.

HR Security Policy

Personnel-security obligations adapted to a one-person organisation, with future-personnel procedures.

Business Continuity & Disaster Recovery Plan

Recovery objectives (RPO/RTO), backup strategy, restore procedures, and continuity scenarios including founder unavailability.

Transfer Risk Assessment — Singapore

Documented assessment of EEA→Singapore data transfers under the 2021 EU SCCs and EDPB Recommendations 01/2020.

Transfer Risk Assessment — United States

Documented assessment of onward transfers to US-based sub-processors under the EU-US Data Privacy Framework and 2021 SCCs.

Master Service Agreement — Template

The commercial contract that governs every Cadences customer engagement: Service definition, fees and invoicing, term, SLA, IP, liability, governing law. Pairs with the DPA below; per-deal commercial details go on a separate Order Form (Annex C of the template).

Data Processing Agreement — Template

Template DPA incorporating the 2021 EU SCCs Module 2 (Controller → Processor), used for new customer engagements. Sits on top of the Master Service Agreement above.

Incident Response Runbook

Operational steps to handle a security or privacy incident, complementary to the Incident Management Policy.

Security Questionnaire — Pre-filled Responses

Pre-answered version of the standard CSA CAIQ-Lite questionnaire for procurement and vendor-review use.