Security
Security
Security is designed into how we work and what we deliver, not added at release.
- Updated:
This page sets out the standards Vitalos works to and is putting in place. They are commitments, not certified controls.
In our own operations
Vitalos is putting in place a minimum security foundation for its own systems:
- multi-factor authentication and least-privilege access on critical systems, with periodic access reviews;
- managed credentials and secrets, which are never committed to source control;
- timely security updates, and vulnerability and dependency management;
- a documented security incident response procedure;
- joiner, mover and leaver access processes, including for contractors;
- an inventory of suppliers and of the third parties that process data for us.
In the systems we deliver
Our delivery standard is:
- security and privacy by design, proportionate to exposure, data, business criticality and regulatory context;
- version control, peer review and automated checks before material changes reach production;
- a security gate before release, reviewing attack surface, identity, secrets and dependency risks;
- contractors and partners working to Vitalos security standards, with access removed promptly when no longer needed.
Reporting a security concern
Security contact: support@vitalos.co.uk.