Data Handling and Security Policy:

Last updated: September 25, 2026

Purpose:

This policy establishes guidelines for handling, storing, and securing data within the organization. It ensures compliance with ISO 19650, ISO 27001, and other relevant standards to protect sensitive information from unauthorized access, breaches, or misuse.

Scope:

This policy applies to all employees, contractors, third-party vendors, and systems involved in data collection, processing, transmission, and storage.

Data Classification:

All data is being classified into the following categories:

  • Public: Information that can be freely shared.

  • Internal: Business data that should not be shared externally.

  • Confidential: Sensitive business data requiring controlled access. By default, project data falls under this classification and follows its own project structure for execution.

Data Handling Procedures:

Data Storage

  • All sensitive data is hosted and stored within Pinnacle’s on-premises data center, ensuring centralized access for project-related work (depending on the nature of the project).

  • Backup and disaster recovery copies are stored offsite with encryption. Access to these backups is restricted to authorized IT personnel only.

Data Transmission:

  • All data in transit (e.g., email, cloud) is encrypted using the latest TLS protocols.

  • Egnyte Cloud is used to exchange data with clients and AES 256-bit encryption to protect data at rest.

  • Project team members can only send emails to pre-approved client or external domains. Sending emails to non-approved external domains isrestricted.

  • Access to external drives and removable storage devices is completely blocked across all systems to prevent the unauthorized transfer or storage of sensitive data. This measure ensures that no sensitive information is inadvertently or maliciously copied to external media.

  • Secure protocols such as HTTPS are used for data exchanges to ensure secure transmission.

Access Control & Authentication

  • Centralized Access Management: We have implemented a centralized access management system to ensure that access to project-specific data is restricted and ensuring that only authorized team members assigned to that particular project can access its data. This approach prevents unauthorized access from individuals outside the designated project team, maintaining strict confidentiality for each project.

  • Role-Based Access Control (RBAC): Our role-based access control (RBAC) system further strengthens data security by ensuring that access to sensitive project information and IT services is granted based on each team member’s role and responsibilities. Each project team member is given access only to the systems and data necessary for performing their job duties, following the principle of least privilege. This minimizes the risk of unauthorized access and ensures that sensitive data is only accessible to those who need it for their tasks.

  • Multi-Factor Authentication (MFA): is enabled for all sensitive systems and we guarantee that only designated project members can view, modify, or exchange project data.

  • Project Access Management: through in-house project management application for access rights review in real-time and in every three months to remove unnecessary privileges.

Data Encryption:

  • AES 256-bit encryption is used for data at rest to ensure high-level protection of sensitive data stored within the organization.

  • TLS 1.2/1.3 is used for data in transit, ensuring secure communication channels during data transfer.

Monitoring & Logging:

  • Monitoring and logging mechanisms are in place for IT systems to detect and respond to suspicious.

Threat Detection & Incident Response:

  • Intrusion Detection Systems (IDS)/Intrusion Prevention Systems (IPS) are deployed to safeguard business data and detect any unauthorized access attempts.

  • Security incidents are reported immediately within the IT system for prompt response and resolution.

  • A change management process is in place to log and review infrastructure changes, ensuring accountability and traceability.

Compliance & Auditing:

  • Regular security audits are conducted to ensure compliance with ISO standards and internal security policies.

  • Periodic employee security awareness training is conducted to reinforce secure practices and ensure all personnel understand their role in protecting sensitive information.