Softsync Security Policy (Public)
Scopic protects Softsync customer information through the security practices described here. They apply to every personnel who works for Scopic and to the systems they use.
Purpose, scope and governance
This policy sets out how Scopic protects the confidentiality, integrity and availability of the information, systems and software it is trusted with. It applies to all Scopic employees and independent contractors, and to the software, systems and tools we build, operate or use, including apps we publish on third-party marketplaces.
Security is owned by Scopic’s senior technology leadership, supported by the IT team.
Security principles
Our approach rests on five principles:
- Risk-based: we identify, assess and prioritize security risks, and apply controls in proportion to them.
- Least privilege: people and systems get only the access they need to do their work, and no more.
- Layered controls: no single control is relied on alone; we combine preventive, detective and corrective measures.
- Protection of client/customer data: client/customer and partner information is treated as confidential and used only for the purpose it was provided.
- Accountability: security responsibilities are assigned, and issues are reported and tracked until resolved.
Protecting data and systems
- Access control: access to systems and data is granted by role and need, protected by strong authentication, and removed when no longer required.
- Data protection: information is classified by sensitivity and handled accordingly. Sensitive data is shared only through approved channels and is protected throughout its lifecycle.
- Secure development and operations: software is tested before release, changes to production are controlled and reversible, and development, testing and production environments are kept separate.
- Vulnerability management: our systems are scanned for vulnerabilities, findings are prioritized by risk and severity, and fixes are tracked and verified.
- Third parties: we consider security when selecting the tools and service providers we rely on, and we expect those with access to client data to protect it appropriately.
- People: everyone who works for Scopic is expected to follow our security policies and to report suspected problems promptly.
Reporting security issues and incident response
To report a suspected vulnerability or security incident affecting Scopic or any of our products, email incidents@scopicsoftware.com. Please include enough detail for us to investigate, and avoid including sensitive data in the report.
We investigate reports, work to contain and fix confirmed issues, and notify affected clients/customers and partners as required by our agreements and applicable law.
Review and contact
We review this policy periodically and update it as our systems, risks and legal requirements change.
Security contact: it@scopicsoftware.com
