Information security,
built into everything
we deliver.
At SoftPak Financial Systems, information security is integral to how we develop, deliver, and support financial technology solutions. Our Information Security Management System (ISMS), implemented and maintained by our development center, in alignment with ISO/IEC 27001:2022 requirements, provides a structured framework for managing information security risks and protecting the confidentiality, integrity, and availability of information.
Through defined policies, security controls, and ongoing pro-active risk management, we work to safeguard information, support operational resilience, and maintain the trust of our clients and partners.
Your InformationSecurity controls
Our information security practices span access management, data protection, infrastructure security, business operations continuity, change management, and incident response. These controls support a consistent approach to managing security risks across SoftPak's operations, products, and client services.
Access Control
Who can reach which systems, with what level of privilege, and for how long. Access is governed at every stage, from the first sign-in to the day it is revoked.
Multi-factor and secure authentication
Access to systems and information is governed by defined authentication requirements. Appropriate safeguards, including multi-factor authentication (MFA), password requirements, and secure authentication mechanisms, help protect against unauthorized access.
Role-Based Access Control (RBAC)
Access privileges are assigned according to defined roles and business responsibilities. This approach helps ensure that personnel have access only to the systems and information necessary to perform their duties.
Privileged Access Restrictions
Administrative and privileged access is restricted to authorized personnel based on business requirements and established access control policies, helping reduce the risk of unauthorized system changes or access to sensitive information.
Periodic Access Reviews
User access privileges are reviewed periodically to help ensure that permissions remain appropriate, authorized, and aligned with current responsibilities. Reviews of privileged access help reinforce accountability and access governance.
Employee Offboarding and Access Revocation
Access rights are addressed as part of the employee offboarding process. Timely revocation of access helps protect SoftPak's systems and information when employment or access requirements change.
Data Security
Data Handling and Encryption
SoftPak maintains documented information security policies and procedures to guide the appropriate handling, storage, and protection of information. Security measures are applied in accordance with relevant requirements to help protect information against unauthorized access, disclosure, alteration, or loss.
Handling
Guided by documented policies
Storage
Kept under defined procedures
Protection
Including encryption measures
Information is protected against
- Unauthorized access
- Disclosure
- Alteration
- Loss
Infrastructure Security
We look for weaknesses before anyone else can, then fix what we find according to risk.
Penetration Testing
Security testing, including penetration testing where applicable, helps identify potential weaknesses in systems and infrastructure. These are conducted at a defined periodic frequency, and findings are assessed and addressed through appropriate remediation processes to support ongoing security improvements.
Vulnerability Assessment and Management
Vulnerability management activities help identify, assess, and prioritize potential security weaknesses across relevant systems and infrastructure. Remediation measures are guided by risk and support the continued improvement of SoftPak's security posture.
Availability and Business Continuity
Keeping services running, preparing for disruption, and proving the plan works.
Infrastructure Capacity Planning
Infrastructure and system capacity are reviewed to help support performance, reliability, and service availability. Capacity planning helps identify potential constraints and assess the impact of anticipated changes in operational requirements.
Infrastructure monitoring and alerting
Monitoring provides oversight of system performance, resource utilization and potential security events. Automatic alerts and robust follow-up procedures help identify and investigate unusual activity and operational issues.
Data Backup and Recovery
Backup and recovery arrangements help protect information against loss and support the restoration of data when required. These measures form part of the broader approach to maintaining information availability and operational resilience.
Business Continuity and Disaster Recovery
Business continuity and disaster recovery arrangements support preparedness for unexpected disruptions. Defined procedures help guide response and recovery activities, with the aim of restoring critical operations and minimizing disruption to services.
Business Continuity and Disaster Recovery Testing
Business continuity and disaster recovery arrangements are periodically reviewed and tested, across operational units and products, to evaluate their effectiveness, identify potential gaps, and implement improvements in recovery procedures to achieve desired business continuity objectives.
Change Management
Every change to our applications and infrastructure follows a controlled path from source code to production.
- 1Code
Source code access restrictions
Access to source code and production environments is controlled to help prevent unauthorized modifications to applications and systems. Permissions are assigned to authorized personnel in accordance with established access requirements.
- 2Review
Code review and change validation
Software changes are subject to appropriate scrutiny and validation processes involving both manual and automated reviews, to help identify potential issues before implementation. These practices support software quality and help reduce security risks associated with changes to applications and systems.
- 3Approve
Reviewed and approved changes
Application and infrastructure changes are managed through defined change management procedures. Appropriate review, testing, and authorization help reduce the risk of unintended changes affecting system security, stability, or availability.
- 4Isolate
Separation of development and production environments
Development, testing, and production environments are managed with appropriate separation and access restrictions. These safeguards help protect production systems and information from unauthorized changes and unintended impacts.
- 5Deploy
Deployment monitoring and notifications
Deployment activities are managed through established processes to support visibility into production changes. Relevant monitoring and notifications, where implemented, help keep appropriate personnel informed of significant deployment activities.
Incident Response
When something looks wrong, our people know how to raise it, and every incident leaves us stronger than before.
Raise
Suspected incidents, concerns and control failures are reported
Escalate
Timely escalation for assessment and coordination
Assess
Impact and contributing factors are evaluated
Contain and resolve
Containment and resolution are confirmed
Learn
Lessons learned are documented
Improve
Corrective actions are identified and tracked
Incident Reporting and Escalation
Defined reporting and escalation procedures help guide personnel in raising suspected security incidents, information security concerns, and potential control failures. Timely escalation supports appropriate assessment, coordination, and response.
Post-Incident Review and Analysis
Security incidents are reported and reviewed as per documented incident management procedures to assess their impact, identify contributing factors, ensure containment and resolution, and document lessons learned. Corrective actions are identified and tracked as appropriate to address underlying issues and strengthen information security practices.
uRebal Hub: AI Integration and Data Processing
uRebal Hub integrates AI capabilities to support meeting recording, transcription, speaker identification, and summarization. These capabilities rely on specialized third-party service providers, while AWS provides the hosting infrastructure for the platform.
SoftPak's approach to managing uRebal Hub's data processing considers the services involved, applicable data-handling requirements, and the security measures governing the platform's operations.
Third-party service providers
uRebal Hub uses the following third-party providers to support its functionality.
Recall.ai
Supports meeting recording.
Deepgram
Supports speech-to-text transcription and speaker diarization.
OpenAI
Supports AI-powered meeting summarization.
Provides hosting infrastructure for uRebal Hub.
SoftPak may evaluate additional AI model providers, including Anthropic, as platform requirements evolve.
Third-party services and infrastructure
uRebal Hub brings together specialized technology providers to support its meeting intelligence capabilities and platform infrastructure. We prioritize transparency around the services involved and how data is processed and managed across these providers.
Data retention and processing region
Data retention and processing-region arrangements for uRebal Hub follow the applicable arrangements established for the platform and its service providers. Details concerning retention periods, processing locations, and deletion practices should be confirmed against the relevant provider agreements and internal security requirements.