Compliance & Information Security Policy

We have implemented the following security measures on our servers:

• Our delivery centers are ISO 27001 ISMS certified.
• We use technologies & platforms like Google, Amazon, UiPath, and Acronis, who may have clusters of servers across the world and may also collect and hold your personal information overseas across a large multiple of countries.
• All our delivery centres are equipped with NextGEN Firewall, which offers security measures including intrusion prevention, web filtering, zero-day protection and sandboxing.
• All delivery centres have access to a minimum of two internet service providers, to ensure business continuity.
• All our endpoints and servers benefit from antivirus software, which offers security measures including intrusion prevention and detection, anti-phishing, anti-malware  and firewall and browsing protection.
• All our servers are geofenced and can be accessed only from our delivery centres.
• All critical infrastructure including data is backed up regularly.
• Access to internal data is controlled and only legitimate users are given access via service requests and approvals. 
• Our service providers and partners are engaged under strict non-disclosure agreements and service level agreements, to ensure adequate support.
• We execute restoration tests every quarter to ensure all backed up data can be restored successfully.
• We run business continuity and disaster recovery drills twice per year, to ensure there is no impact on our business operations in case of any disaster at any of our delivery centres. 
• All our endpoints and servers are patched regularly and hardened to ensure security standards are maintained.
• We perform external vulnerability assessment and penetration testing for all our critical portals and websites, to ensure optimum security against any cyber threats.
• Internet activity is monitored and controlled within the server environment.
• Our staff are restricted from accessing personal email accounts within the office network, and work email accounts are configured to prevent sending data outside the office network. 
• Our intranet, internal portals, software and sites have IP authentication in place so that no one can access these records outside our office premises.
• Users access the systems via secure SSO (Single Sign-On) access. Credentials are safely stored in the vault and not shared with users. Internal software access is password-protected with enforced strength and regular update requirements.
• Our security software is regularly updated with the latest definition signatures in accordance with the security device OEM (Original Equipment Manufacturer) guidelines.
• All PCs within our organisation have an auto-lock feature to ensure PCs are not kept unlocked.
• Network connections are permitted only for Befree’s authorized official devices.
• We allow staff to work remotely from time to time. We make sure that staff exclusively work on the computer systems provided by the office and exclusively use the VPN when working and accessing our servers.