Verifiable evidence.
Audited annually.

1. Security & Compliance Overview

EFROS operates as a cybersecurity-first managed service provider. Every engagement runs under documented controls aligned to recognised frameworks. Independent attestations and partner-tier letters are reviewed annually and provided under NDA to qualified prospects.

2. Certifications & Partner Evidence

EFROS holds certifications and partner statuses across the major technology vendors and frameworks our clients require. Each is independently verified annually. Documentation, audit attestations, and partner-tier letters are available under NDA for qualified clients and their reviewers.

• ISO/IEC 27001:2022 — Information Security Management
• SOC 2 Type II — Annual attestation
• Microsoft Solutions Partner — verified via Microsoft Partner Center
• AWS Advanced Tier Services Partner
• Cisco Premier Partner
• CompTIA Security+ — team-wide credentialing

3. Documentation Available Under NDA

The following are released to qualified clients and their insurance, legal, or audit reviewers under mutual non-disclosure agreement.

• SOC 2 Type II Report (current period)
• ISO 27001 Statement of Applicability (SoA)
• Information Security Policy + supporting standards
• Business Continuity & Disaster Recovery Plan
• Incident Response Playbook (sanitised)
• Third-party penetration test executive summary
• Insurance certificates — cyber, professional indemnity, general liability
• Sub-processor list with data flow diagram

4. Data Handling

Client data remains in the client's own tenant by default. EFROS engineers operate with the minimum-necessary access required for the engagement. Read-only auditor or global-reader roles are preferred where the task allows; elevated access is time-boxed, logged, and reviewed.

• Default: data stays in client tenant; EFROS does not retain custody
• Encryption at rest: AES-256 on all EFROS-managed systems
• Encryption in transit: TLS 1.2+ with HSTS + MTA-STS enforcement
• Audit logs: 12-month minimum retention; longer for regulated scope
• Access reviews: quarterly for all client tenants
• Sub-processor disclosure: complete list under NDA

5. Privacy & Confidentiality

EFROS operates against GDPR, UK GDPR, CCPA / CPRA, HIPAA (where BAA in place), and PIPEDA expectations. Every engagement contract includes confidentiality covenants. Employees are bound by individual confidentiality agreements and trained annually on data-handling procedures.

• Annual data-protection training for every employee
• Background screening for production access
• Multi-factor authentication on every system
• Privileged access management (PAM) with session recording for sensitive systems
• Onboarding / offboarding within 4 business hours under documented runbook

6. Incident Response Process

If an incident affects a client environment, the 24×7 SOC contains first, communicates with the client's designated incident contact, and follows the runbook documented during the engagement onboarding.

• Severity 1 (customer-impacting): 30-minute acknowledgement, 4-hour resolution target
• Designated incident contact named at engagement start, validated quarterly
• Forensic readiness: timeline preservation, memory captures, chain-of-custody
• Regulatory notification timing tracked against jurisdiction (e.g. OCR for HIPAA, NYDFS 23 NYCRR 500 §500.17, GDPR 72-hour clock)
• Post-incident review with root-cause analysis and remediation roadmap

7. Insurance & Risk Documentation

EFROS carries cyber-liability, professional-indemnity, and commercial-general-liability coverage. Certificates of insurance are provided to qualified prospects under NDA. Carrier-specific attestations available for clients whose own cyber insurance requires vendor-side documentation (Beazley, Chubb, AIG, Travelers, and the major specialty markets).

8. Vendor Due Diligence Contact

For procurement reviewers, security questionnaires (SIG, CAIQ, SAQ, custom), and audit requests, route directly to our compliance team. We typically return completed questionnaires within five business days.

• Email: trust@efros.com
• Standardised: SIG Core, SIG Lite, CSA CAIQ
• Custom questionnaires: returned with evidence references and policy excerpts
• Audit calls: scheduled within 10 business days, attended by EFROS security lead

9. Responsible Disclosure

Security researchers reporting vulnerabilities in EFROS-operated systems or client environments under our scope are welcomed. We follow a coordinated disclosure model and do not pursue legal action against researchers who act in good faith.

• Contact: security@efros.com
• PGP key + security.txt published at /.well-known/security.txt
• Triage: acknowledged within 2 business days
• Validation window: typically 7-30 days depending on scope
• Coordinated disclosure window: 90 days by default, adjustable for active exploitation