Security & Ephemeral Access Policy

Purpose

This policy explains how Mazel Grand HMS protects client data and why we use an ephemeral access model: data is accessed only to deliver the engagement, only by authorised personnel, and is deleted after delivery.

Our security model is designed around data minimisation, isolation, and time-limited access. We do not build data warehouses or retain client data beyond the engagement scope.

Ephemeral access model

Ephemeral access means that access to client data is temporary, purpose-bound, and automatically revoked when the engagement concludes.

Purpose-bound: access is granted only for the specific purpose defined in the engagement scope.
Time-limited: access credentials are valid only for the duration of the engagement.
Person-specific: access is granted only to individuals directly assigned to the engagement.
Automatic revocation: access is revoked when the engagement is marked complete.
No long-term storage: we do not retain client data after delivery unless explicitly agreed.

Data handling lifecycle

Client data follows a controlled lifecycle from receipt to deletion:

Ingestion: data is received through secure channels and logged in an access-controlled environment.
Processing: data is processed within an isolated workspace specific to the engagement.
Delivery: analysis results and reports are delivered to the client through secure channels.
Retention: working files and source data are retained for a limited period for support purposes.
Deletion: all client data is securely deleted after the retention period expires.

Access controls

We implement strict access controls to ensure only authorised personnel can access client data.

Least privilege: personnel are granted the minimum access necessary to perform their role.
Role-based access: access is based on job function and engagement assignment.
Authentication: all systems require strong authentication with multi-factor where available.
Session management: sessions time out after inactivity and must be re-authenticated.
Access logging: all access to client data is logged and auditable.
Access review: access rights are reviewed regularly and revoked when no longer needed.

Encryption and security

All client data is protected by encryption at multiple layers.

Encryption in transit: data transfers use TLS 1.2 or higher encryption.
Encryption at rest: data stored on our systems is encrypted using industry-standard algorithms.
Key management: encryption keys are managed securely and rotated regularly.
Secure storage: data is stored in environments with physical and logical security controls.
Secure disposal: data deletion uses secure erasure methods that prevent recovery.

Isolation and segregation

Client data is isolated from other clients and from our internal systems.

Engagement-specific workspaces: each engagement operates in a dedicated environment.
Logical separation: data from different clients is logically separated at the application level.
No data mixing: client data is never combined with data from other clients.
No cross-use: client data is never used to serve other clients or to build products.
No model training: client data is never used to train machine learning models or improve our services.

Data retention and deletion

We retain client data only for as long as necessary and delete it securely.

Default retention: client data and working files are deleted within 30 days after delivery of the final report.
Earlier deletion: clients may request immediate deletion after handover or at any time.
Extended retention: longer retention is only possible with a written agreement and a justified business need.
Secure deletion: data is deleted using secure methods that prevent recovery.
Backup deletion: backup copies are deleted in accordance with the same retention schedule.
Verification: we verify deletion through logs and, where applicable, confirmation from the data custodian.

Data transfer and delivery

When we deliver reports or analysis results to clients, we use secure methods.

Secure channels: reports are delivered through encrypted email or secure file transfer.
No unencrypted email: sensitive data is never sent as unencrypted email attachments.
Client preference: we adapt delivery methods to client security requirements where feasible.
Delivery confirmation: we confirm delivery of sensitive materials and verify receipt.

Incident response

We maintain procedures for detecting, responding to, and reporting security incidents.

Incident detection: we monitor for unusual activity and potential security events.
Incident classification: incidents are classified by severity and impact.
Client notification: we notify affected clients without undue delay if their data may be impacted.
Containment: we take immediate steps to contain and mitigate incidents.
Investigation: we investigate the root cause and implement corrective actions.
Regulatory notification: we comply with legal requirements for reporting data breaches.

Staff training and awareness

All personnel with access to client data receive security training.

Onboarding: new team members complete security training before accessing client data.
Regular updates: security awareness training is provided periodically.
Policy awareness: staff are trained on this policy and their specific security responsibilities.
Phishing awareness: staff are trained to identify and report phishing attempts.
Reporting: staff know how to report security concerns promptly.

Third-party dependencies

We use third-party services for infrastructure and tools. We ensure these services meet our security standards.

Vendor assessment: we assess the security practices of critical vendors before engagement.
Contractual requirements: vendors must meet contractual security and data protection obligations.
Data location: we understand where our vendors store data and ensure compliance with data protection laws.
Monitoring: we monitor vendor security posture and respond to vendor incidents.

Compliance and review

This policy is reviewed regularly to ensure it remains effective and compliant with evolving security standards.

Annual review: this policy is reviewed at least annually.
Regulatory updates: we update the policy when regulations or standards change.
Incident-driven review: we review and update the policy after significant security incidents.
Best practices: we incorporate industry best practices as they emerge.

Client responsibilities

Clients also have responsibilities for protecting their data when working with us.

Data provision: ensure you have the right to share the data with us.
Secure transfer: use secure methods when sending data to us.
Credential protection: protect any credentials we provide for accessing shared resources.
Timely review: review deliverables promptly and report issues within the agreed timeframe.

Contact

Security questions or concerns: info@mazelgrandhms.com.

To report a security incident: include "Security incident" in the subject line.

To request data deletion: include "Data deletion request" in the subject line.