Legal & Compliance

Security Baseline & Enterprise Trust Framework

Operational Security Posture, Cloud Isolation, SSDLC Standards, and Breach Protocols

Effective Date: January 01, 2026
Version : 2.4
Enterprise Security Baseline: This document establishes our operational security standards. When retaining dedicated pods or undertaking architecture modernization, client-specific Information Security Exhibits (ISE), SOC 2 reports, and custom Service Level Agreements (SLAs) executed under a bilateral Master Services Agreement supersede this policy.

1. Contractual Scope & Custom Security Exhibits

Security is embedded across every operational stage at Codixon (an enterprise technology initiative of Proficed). This policy details the technical and operational controls governing our engineering environments, developer tooling, and client deliverables.

For contracted enterprise engagements, specific security commitments—including custom SOC audit access, bespoke penetration test frequencies, and dedicated encryption key custody (BYOK)—are formalized via tailored Information Security Exhibits incorporated into the governing Master Services Agreement.

2. Zero-Trust Architecture & Cloud Boundary Defense

We enforce an uncompromising Zero-Trust posture across all development networks, deployment nodes, and administrative interfaces:

  • Perimeter Elimination & Identity Federation: Internal networks operate on the assumption of breach. Access to development nodes, build clusters, and internal documentation requires multi-factor authentication (FIDO2/WebAuthn hardware tokens preferred) with device posture checks.
  • Network Micro-segmentation: Build clusters, artifact repositories, and testing workloads run within isolated Virtual Private Clouds (VPCs). Inbound traffic from public networks is blocked by default, requiring mutual TLS (mTLS) or hardened WireGuard/IPsec VPN bastions.
  • Immutable Infrastructure: Automated provisioning leverages hardened container images and declarative Infrastructure-as-Code (IaC) templates subjected to pre-merge policy compliance checks.

3. Cryptographic Standards & Tenant Data Isolation

We adhere to strict cryptographic isolation protocols to safeguard client assets and proprietary codebases:

  • Data in Transit: All HTTP and internal service-to-service communications mandate TLS 1.3 (with fallback to TLS 1.2 using modern PFS cipher suites). Plaintext protocols are disabled at the edge router level.
  • Data at Rest: Repository volumes, CI artifacts, and secret stores utilize AES-256 encryption. Cryptographic keys are managed via hardware security modules (AWS KMS / Azure Key Vault) with automated rotation schedules.
  • Strict Client Separation: Client source code, database dumps, and deployment configurations are strictly segregated into dedicated, siloed cloud directories and separate AWS/Azure accounts. Cross-tenant credential sharing or co-mingling of source artifacts is architecturally prohibited.

4. Secure Software Development Lifecycle (SSDLC)

Our delivery pods adhere to shift-left security principles integrated into every stage of the pipeline:

  • Automated SAST & Secret Scanning: Every commit is inspected for vulnerabilities and hardcoded credentials before entering branch review. Commits violating security rules are automatically rejected by pre-receive hooks.
  • Software Composition Analysis (SCA): Third-party dependencies are continuously monitored against active CVE catalogs. Critical vulnerabilities halt CI/CD build promotion immediately.
  • Container Hygiene & DAST: Container images undergo automated static layer analysis and runtime dynamic scans in ephemeral staging clusters prior to release candidate signing.

5. Human Operations, RBAC & Workstation Hygiene

Human operational access is bounded by the principle of least privilege:

  • Role-Based Access Control (RBAC): Pod engineers receive short-lived, task-bounded credentials strictly mapped to the repositories and cloud environments required for active sprint tickets.
  • Managed Endpoints: Engineering endpoints run enterprise EDR (Endpoint Detection & Response), mandatory full-disk encryption (BitLocker/FileVault), centralized patch management, and strict USB/external storage lockout policies.
  • Offboarding Protocols: Deprovisioning occurs via centralized identity providers within two (2) hours of engagement conclusion or personnel reassignment.

6. Disaster Recovery, Resilience & SLA Backstops

Our build platforms, shared repositories, and continuous integration engines maintain multi-region availability and robust recovery targets:

  • Recovery Point Objective (RPO): Automated snapshots and asynchronous multi-zone replication ensure an RPO of less than one (1) hour for configuration state and code repositories.
  • Recovery Time Objective (RTO): Fully automated IaC orchestration enables full platform infrastructure recovery within four (4) hours in the event of an upstream regional provider outage.

7. Coordinated Vulnerability Disclosure & Incident SLAs

We maintain an active Security Operations Desk to field external disclosures and orchestrate rapid remediation:

  • Reporting Channel: Suspected vulnerabilities or security discrepancies may be submitted directly to security@codixon.com using our published PGP key.
  • Triage & Initial SLA: Critical reports are acknowledged within two (2) hours, with an expedited technical assessment completed within twelve (12) hours.
  • Breach Notification: In the confirmed event of unauthorized access to client-identifiable data or code repositories, affected client technical leads are notified within twenty-four (24) hours of verification, accompanied by root-cause forensics and containment steps.

Questions regarding these terms? Contact our legal team at security@codixon.com.