Skip to main content

Compliance & Governance

Governance, Risk & Assurance​

Security Governance​

Security starts with clear ownership and accountability.

Definity maintains documented security policies, standards, procedures, and responsibilities designed to provide a consistent framework for protecting company and customer information.

Our security program addresses:

  • Security governance
  • Risk management
  • Asset and information protection
  • Identity and access management
  • Security awareness
  • Vulnerability management
  • Security testing
  • Change management
  • Security monitoring
  • Incident response
  • Business continuity
  • Disaster recovery
  • Third-party risk management
  • Privacy and data protection
  • Continuous improvement

Security leadership is responsible for maintaining and evolving the security program, while management provides oversight of significant security, business, and control matters.

Security Policies​

Definity maintains formal policies and procedures covering key areas of information security and operations.

Policies are reviewed periodically to ensure they remain aligned with changes in technology, business operations, customer requirements, applicable regulations, and the evolving threat landscape.

We treat security policies as living guidelines that evolve as our environment and risks change.

Risk Management​

Definity applies a risk-based approach to security.

Risks may be identified through security assessments, penetration testing, vulnerability assessments, security monitoring, operational reviews, third-party assessments, external cybersecurity advice, customer requirements, and changes in the threat landscape.

Identified risks are evaluated according to factors including potential impact, likelihood, severity, exposure, and applicable mitigating controls.

Risk management is an ongoing process designed to identify and reduce exposure before issues become security events.

Independent Assurance​

Definity maintains a SOC 2 Type II examination covering the Security Trust Services Criterion, conducted by Deloitte.

The examination evaluates the design and operating effectiveness of applicable controls over a defined examination period. The current examination was completed with no exceptions identified.

Qualified customers and prospects may request applicable assurance documentation subject to appropriate confidentiality requirements.

External Security Expertise​

Definity supplements its internal security program with independent external expertise.

Our security program is supported by:

  • Deloitte as the independent SOC 2 auditor
  • An external cybersecurity advisor providing ongoing independent perspective
  • An external CISO as a Service advisor providing ongoing security expertise
  • An independent third party conducting penetration testing at least annually

External assurance and expertise complement Definity's internal security processes and continuous improvement program.

Continuous Improvement​

Definity continuously evaluates and improves its security program based on:

  • Security testing
  • Vulnerability findings
  • Risk assessments
  • Security events
  • Audit activities
  • Operational experience
  • External security advice
  • Customer requirements
  • Changes in applicable regulations
  • Changes in the threat landscape

Privacy & Regulatory Commitments​

GDPR​

Definity is committed to protecting personal data and supporting applicable requirements under the European Union General Data Protection Regulation.

Our privacy and security practices incorporate principles including:

  • Lawfulness, fairness, and transparency
  • Purpose limitation
  • Data minimization
  • Accuracy
  • Storage limitation
  • Integrity and confidentiality
  • Accountability

Security of Processing​

Definity applies technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction.

These measures include applicable access controls, authentication, encryption, security monitoring, vulnerability management, security testing, incident response, risk management, and organizational safeguards.

Data Subject Rights​

Where applicable, Definity supports processes designed to facilitate data-subject rights, including access, rectification, erasure, restriction of processing, data portability, and objection.

CCPA / CPRA​

Definity is committed to supporting applicable requirements under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Where applicable, Definity supports processes relating to rights including access, deletion, correction, applicable opt-out rights, and rights relating to sensitive personal information.

The applicability of specific rights depends on the nature of the information, processing activity, relationship, and applicable law.

International Data Transfers​

Where personal data is transferred across jurisdictions, Definity manages such transfers in accordance with applicable legal requirements and contractual arrangements - Standard Contractual Clauses (SCC).

Customers with specific data-residency requirements can discuss regional deployment options with the Definity team.

Last updated on