Information Security Policy

1. Data hosting and architecture

• Member data is stored in Supabase (PostgreSQL) in the EU, in Frankfurt, Germany
• Data is encrypted in transit with TLS on every connection, and encrypted at rest in the database
• Server-side functions handle all privileged operations. Secret keys are held only on the server, in a managed vault, never in app or website code
• The marketing website and the member app’s web pages hold no member data; everything a member sees is fetched from the database under their own login

2. Access control

• Row-level security is enabled on every table that holds member data, so each member can only read and write their own records. New tables must have row-level security enabled before they hold any data
• Staff access to member data is limited to named people who need it for their role, and is reviewed every quarter
• Administrative actions in the VYVE admin console are written to an audit log that cannot be edited
• Multi-factor authentication is required on every account with administrative access to VYVE systems and providers
• Employer and partner portals return only aggregated or scoped data, enforced on the server, not in the browser
• Access is removed on the day someone leaves or no longer needs it

3. Secure development

• Every database change is applied as a recorded migration
• A daily automated check records the database’s access-control posture (row-level security, policies, function permissions) and raises an alert on any change that widens exposure. Findings rated critical are fixed before the next release
• AI prompts and safeguarding detection are tested against fixed scenarios before changes go live
• Engineering work on the platform uses AI-assisted tooling under the same provider terms as our AI features: no training on VYVE data, and every change is reviewed and recorded before it reaches members
• App updates are monitored automatically for errors after release, and can be rolled back

4. Monitoring, backups and continuity

• Platform errors and failures are logged centrally and raise alerts to the team, with critical alerts pushed to a named person immediately
• Safeguarding alerts are written to a permanent record before any email is sent, so an email failure cannot lose a flag
• The database is backed up automatically every day by our hosting provider
• If a critical provider is unavailable, the app continues to show members urgent support information
• Business continuity and key-person handover procedures are documented so that either director can operate every system

5. Incident response

1. Anyone who suspects a security incident or personal data breach reports it to the CEO or CTO immediately
2. The CTO contains the incident and preserves evidence. The CEO leads the response and communication
3. Within 24 hours we assess the risk to members
4. Where required, we notify the ICO within 72 hours of becoming aware, affected members without undue delay, and affected employer clients within 72 hours
5. Every incident is recorded, with a review of causes and actions, within 14 days

6. Suppliers

• Every provider that processes member data is bound by a written data processing agreement and listed in our Sub-processor Register
• We review each provider’s security and data location before we use it, and every 12 months after
• Employer clients get at least 30 days’ notice before we add a sub-processor that handles member data

7. People

• Everyone with access to member data signs a confidentiality agreement and completes data protection training before access is granted, then every year
• Devices used to access VYVE systems must use full-disk encryption, a screen lock and up-to-date software
• Member data is never stored on personal devices or shared through personal email or messaging apps

8. Review

The CTO reviews this policy every 12 months and after any security incident. Our completed security questionnaire, which states the current status of each control including items still scheduled, is available to employers on request.

The VYVE policy suite

This document is one of six that together describe how VYVE handles data and keeps members safe. They are written to be read together and use the same facts.