Information security policy

1. Scope

This policy describes the information security principles and controls applied by José Ramón Santos Crespo to both this website and the Almenara platform. It covers information processed on behalf of customers and suppliers, the infrastructure that supports it, and personnel with access to it.

2. Principles (CIA)

We follow the three classic information security principles:

• Confidentiality: information is only accessible to those explicitly authorized to see it.
• Integrity: information is not altered in an unauthorized or accidental way, and any change is traceable.
• Availability: information and the service are accessible when needed, within applicable service level commitments.

3. Access management

Access to systems and information is granted on a least-privilege basis: each person or system has only the access necessary for its function, no more. Access is reviewed periodically and revoked immediately when an employment or contractual relationship ends. Access to production systems requires strong authentication.

4. Encryption

All communication with the site and the platform is encrypted in transit (TLS). Data at rest is stored encrypted on the hosting provider's infrastructure. Encryption keys are managed separately from the data they protect.

5. Vulnerability and patch management

Software dependencies are continuously reviewed for known vulnerabilities, with priority updates for high or critical severity issues. Infrastructure security patches are applied within a timeframe proportional to their severity, always prioritizing service availability.

6. Incident response and breach notification

We maintain a documented security incident response procedure: detection, containment, analysis, resolution and post-incident review. In the event of a security breach affecting personal data, the Spanish Data Protection Agency will be notified within 72 hours of becoming aware of it, as required by the GDPR, and affected individuals will be notified where the risk to their rights and freedoms requires it.

7. Continuity

Regular backups of critical information are performed, with regular restoration testing. A continuity plan covers the most likely infrastructure unavailability scenarios.

8. Training

Personnel with access to data or systems receive periodic training in information security and data protection best practices, tailored to their role.

9. Vendor management

Providers that process information on our behalf (data processors) are selected based on an evaluation of their security guarantees, and are bound by a contract setting out their obligations. The full list of subprocessors is available at Subprocessors.

10. Periodic review

This policy is reviewed at least once a year, and whenever a significant change occurs to the infrastructure, the service, or applicable regulation.

11. Contact

To report a vulnerability or security incident, write to hola@getalmenara.com. See also security.txt for the responsible disclosure procedure.