Information Security Policy

1. Purpose

This Information Security Policy sets out how Balanita Pvt Ltd (“Balanita”, “we”, “us” or “our”) protects the information we hold and the information our clients trust us with. It covers how we classify information, who may access it, how we handle it, and what we do when something goes wrong.

2. Scope

This policy applies to:

• every member of our team, and to contractors and vendors who work with our information or our clients’ information;
• information about Balanita, its team and its business;
• information our clients share with us, or that we can reach while we build, run or support their learning management systems and servers.

It sits alongside our IT Security Policy, which covers our own IT systems, devices and networks in more detail.

3. Principles

We protect three things:

• Confidentiality: information is seen only by the people who need it for their work.
• Integrity: information stays accurate and complete, and changes are made only by authorised people.
• Availability: information and systems are there when the people who rely on them need them.

4. Responsibilities

• Management sets this policy, makes sure the team has what it needs to follow it, and decides on any exception.
• Every team member follows this policy, protects the information they work with, and reports anything that looks wrong straight away.
• Contractors and vendors follow this policy, or equal terms in their agreement with us, for any of our or our clients’ information they handle.

5. Classifying information

We treat information in three classes:

• Public: information we publish, such as the content of our website.
• Internal: information for our team only, such as working documents and internal procedures.
• Confidential: client information, personal data, account credentials, contracts, pricing agreed with a client, and anything a client asks us to keep confidential.

When in doubt, a team member treats information as confidential.

6. Handling information

• Confidential information is shared only with the people who need it, and only through tools Balanita has approved.
• Passwords and other credentials are never sent in plain email or chat messages, and never stored in documents or code.
• Information is kept only as long as it is needed, as set out in our Documents’ Retention/Storage and Deletion Policy.
• Personal data is handled as set out in our Privacy Policy and Data Privacy Policy.

7. Access control

• Access is given on the principle of least privilege: each person gets only the access their work needs.
• Each person uses their own account. Accounts are not shared.
• Multi-factor authentication is used wherever a system offers it.
• Access is removed when a person leaves Balanita, changes role, or no longer works on a client’s system, and access rights are reviewed regularly.

8. Client systems and accounts

Our clients own their learning platforms. Their licences, accounts and cloud bills are in their own name, and Balanita does not own or resell servers.

• We work on a client’s systems only with the access the client gives us, and only for the work agreed with them.
• We do not copy client data out of their systems except where the agreed work needs it, and we delete any copy when that work is done.
• At the end of an engagement, or when a client asks, we hand back or remove our access.

9. Servers we manage

For clients who use Balanita Server Management, we:

• apply security patches within 5 business days of a vendor release, and within 48 hours for an actively exploited vulnerability;
• monitor the server around the clock, with alerts actioned within the client’s support window;
• take daily backups, kept for 14 days, and restore within 4 business hours when needed.

The uptime of the underlying infrastructure sits with the client’s cloud provider, under its own service level agreement, or with the client’s own team.

10. Security incidents

Anyone who suspects a security incident, such as lost credentials, unauthorised access or a suspected data breach, reports it to management straight away. We handle incidents under our Incident Response Policy and Data Breach Response Plan, and we tell any client whose information is affected.

11. Vendors

We choose vendors with care and expect them to protect information to the standard of this policy, as set out in our Vendor Management Policy.

12. Training

Every team member learns this policy when they join and is reminded of it regularly, as set out in our Training and Awareness Programs.

13. Breaches of this policy

A breach of this policy may lead to disciplinary action under our Employee Code of Conduct, or to the end of a contractor’s or vendor’s agreement.

14. Review

We review this policy regularly, and whenever our services, our systems or the law change.

15. Contact

Questions about this policy go to hello@balanita.com.

Effective date: 20 October 2026