Information Security Policy Statement

What we commit to

• Treating client information as confidential and using it only for the purpose for which it was provided.
• Applying access controls so that information is only available to those who need it to do their job.
• Using reputable, suitably configured cloud services, devices and tools for storage, collaboration and communication.
• Encrypting data in transit and at rest where supported by the platforms we use.
• Maintaining backup, recovery and business continuity arrangements proportionate to the risk.
• Reporting, investigating and learning from information security incidents and personal data breaches, and notifying affected parties and regulators where required.

Client information and the ParagonQMS portal

• Client accounts on the ParagonQMS portal are protected by individual credentials and role-based access.
• Documents uploaded to the portal remain the property of the client and are not shared with third parties without authorisation, except where required by law.
• We retain client information only for as long as needed to deliver our services and meet legal, regulatory or certification-evidence requirements, after which it is securely deleted or returned.

People and suppliers

• All ParagonQMS personnel and associates are subject to confidentiality obligations and receive information security and data protection awareness as part of their induction and ongoing development.
• Suppliers and subprocessors that handle client information are reviewed for their security posture and are bound by appropriate contractual safeguards.

Responsibilities

The Managing Director is accountable for information security at ParagonQMS. All personnel, associates and subcontractors are responsible for following this policy, using ParagonQMS systems appropriately, and reporting suspected security events or data protection concerns promptly to portal@paragonqms.com so they can be assessed and acted on.