SECURITY POLICY

PURPOSE

This Security Policy describes the technical and organizational measures implemented by Disruptive Studio, Inc. to protect the confidentiality, integrity, and availability of its Software and all associated data.

This Policy is designed to provide transparency to clients and partners regarding security practices and to align with recognized international standards.

SECURITY PRINCIPLES

Disruptive Studio follows a defense-in-depth strategy based on multiple layers of protection across infrastructure, application, and operational processes.

Security practices are aligned with industry frameworks, including but not limited to NIST 800-53, PCI DSS, GDPR, and HIPAA

The company applies continuous monitoring, proactive threat detection, and rapid incident response to maintain a secure environment.

INFRASTRUCTURE SECURITY

The platform operates on a cloud-based architecture designed for isolation, scalability, and resilience.

Core infrastructure components are deployed within private virtual networks to restrict unauthorized access.

Public access is secured through reverse proxy architecture protected by content delivery networks and web application firewalls, providing protection against DDoS attacks and malicious traffic.

Internal access to infrastructure is restricted and requires secure authentication through controlled network channels, including VPN-based access.

NETWORK SECURITY

Traffic is filtered and monitored at multiple levels to detect and block suspicious activity.

Security layers include:

firewall protections
traffic filtering and rate limiting
network segmentation
continuous monitoring of network activity

These controls are designed to minimize exposure and reduce attack surfaces.

ACCESS CONTROL

Access to systems and data is granted based on the principle of least privilege.

Only authorized personnel have access to production systems, and access is restricted according to role and operational necessity.

Authentication controls are enforced for administrative access, and sensitive operations are limited to approved personnel.

MONITORING AND LOGGING

Disruptive Studio maintains continuous monitoring of infrastructure and application performance.

Monitoring systems track:

server health
microservice activity
performance metrics
security events

Logs are centralized and analyzed to support auditing, anomaly detection, and incident investigation.

Real-time alerting systems are used to detect and respond to operational or security issues.

THREAT DETECTION AND RESPONSE

Security operations include real-time detection and response capabilities.

Systems are in place to identify:

unauthorized access attempts
malicious behavior
system anomalies
potential vulnerabilities

Threat detection is supported by security monitoring tools and methodologies aligned with recognized frameworks such as MITRE ATT\&CK

Disruptive Studio conducts ongoing threat analysis and proactive mitigation efforts.

VULNERABILITY MANAGEMENT

The platform undergoes continuous evaluation to identify and mitigate vulnerabilities.

This includes:

regular system updates
security patching
configuration assessments
malware detection
file integrity monitoring

Vulnerabilities are prioritized and addressed based on severity and potential impact.

APPLICATION SECURITY

The Software is developed and maintained using secure development practices.

Security considerations are integrated into the development lifecycle, including:

code validation
error handling
access control enforcement
input sanitization

Production environments are separated from development environments to reduce risk.

DATA SECURITY

Disruptive Studio implements measures to protect data against unauthorized access, loss, or misuse.

These measures include:

controlled access to data
segregation of environments
encryption practices where appropriate
secure transmission of data

Clients are responsible for managing the data they input into the system and ensuring its lawful use.

INCIDENT RESPONSE

Disruptive Studio maintains procedures for identifying, responding to, and resolving security incidents.

In the event of an incident:

the issue is investigated and contained
impact is assessed
corrective actions are implemented

Where appropriate, clients may be notified in accordance with contractual obligations and applicable laws.

BUSINESS CONTINUITY AND AVAILABILITY

The platform is designed for high availability and operational resilience.

Systems are continuously monitored to detect and resolve performance issues.

However, uninterrupted availability cannot be guaranteed, and clients acknowledge the inherent risks of cloud-based services.

THIRD-PARTY SECURITY

Disruptive Studio relies on third-party providers for certain infrastructure and services.

Reasonable efforts are made to select providers that meet industry security standards.

However, Disruptive Studio does not control third-party systems and is not responsible for their independent security practices.

CLIENT RESPONSIBILITIES

Clients are responsible for:

maintaining the security of their accounts and credentials
controlling access to their users
ensuring proper configuration and usage of the Software
complying with applicable laws and regulations

Security is a shared responsibility between Disruptive Studio and the Client.

LIMITATIONS

While Disruptive Studio implements robust security measures, no system can be guaranteed to be completely secure.

Clients acknowledge that cybersecurity risks evolve and that residual risks remain inherent in any digital system.

UPDATES

Disruptive Studio may update this Security Policy at any time to reflect improvements, regulatory changes, or evolving threats.

Continued use of the Software constitutes acceptance of such updates.

RELATIONSHIP WITH TERMS

This Security Policy forms part of the overall contractual framework governing use of the Software.

In the event of any conflict, the Terms and Conditions shall prevail.