Security policy

1. Scope

It applies to the systems, services and people involved in the design, development and operation of the Acctua Web, Acctua Audit and Acctua Pay solutions and of this website.

2. Framework and certifications

Our security management relies on Spain’s National Security Scheme (Royal Decree 311/2022), with a certificate of conformity at the medium category, and on the ISO/IEC 27001 standard for information security management. [State the scope, the certification body and the validity date of each certificate.]

3. Principles

We protect the confidentiality, integrity and availability of information, as well as the authenticity and traceability of access and actions.

4. Organisation

Management approves this policy and provides resources to the management system. A security officer oversees compliance and coordinates incident response. Every team member receives training and commits to following it.

5. Main measures

• periodically reviewed risk management;
• access control based on least privilege and strong authentication;
• encryption of information in transit and, where appropriate, at rest;
• backups and a continuity plan;
• secure development and review of changes before they go live;
• logging and monitoring of activity;
• selection and review of suppliers with equivalent security requirements.

6. Incident management

We have a procedure to detect, contain, report and learn from incidents. If you believe you have found a vulnerability or an incident, write to accesibilidad@cumuluscity.es.

7. Continuous improvement

We review this policy and the management system at least once a year and after significant changes.