Security & Compliance

At SFL Tech, security is foundational to how we design, implement, and support digital supply chain systems. We operate in environments where operational continuity, system integrity, and data confidentiality are business-critical. Our security and compliance framework is designed to meet enterprise expectations and global regulatory requirements.

1. Our Security Philosophy

Security at SFL Tech is guided by three core principles:

• Confidentiality - Data is accessible only to authorized individuals.
• Integrity - Systems and data remain accurate, consistent, and protected from unauthorized modification.
• Availability - Services remain resilient, stable, and operational.

We implement layered controls across infrastructure, applications, processes, and people.

2. Infrastructure & Cloud Security

Depending on client configuration, our services may be deployed within:

• Secure cloud infrastructure environments
• Customer-hosted environments
• Hybrid configurations

Security controls include:

• Encrypted data transmission (TLS 1.2 or higher)
• Network segmentation
• Role-based access control (RBAC)
• Secure authentication mechanisms
• Logging and monitoring of administrative access and Backup and disaster recovery processes

Where third-party infrastructure providers are used, we engage reputable vendors that maintain internationally recognized security certifications (e.g., ISO 27001, SOC 2 where applicable).

3. Access Control & Identity Management

Access to systems and customer environments is governed by:

• Least-privilege access principles
• Role-based permissions
• Multi-factor authentication (where applicable)
• Controlled administrative access
• Periodic access reviews

Only authorized personnel with a legitimate business need are granted access.

4. Application Security

We apply secure development and configuration practices across:

• System implementation
• Data integrations
• Automation workflows
• Managed service operations

Controls include:

• Secure configuration standards
• Change management procedures
• Environment segregation (where applicable)
• Monitoring of system activity and anomalies

We work closely with clients' IT and InfoSec teams to align with their internal governance frameworks.

5. Data Protection & Privacy Compliance

SFL Tech is committed to compliance with applicable data protection regulations, including:

• General Data Protection Regulation (GDPR)
• UK GDPR
• California Consumer Privacy Act (CCPA)
• California Privacy Rights Act (CPRA)

We operate under defined Controller-Processor responsibilities where applicable and provide:

• Data Processing Addendums (DPA)
• Sub-Processor transparency
• Data subject rights assistance
• Breach notification procedures

We do not sell personal data.

6. Incident Response & Business Continuity

SFL Tech maintains procedures to:

• Detect and respond to security incidents
• Escalate and contain potential threats
• Notify affected customers without undue delay
• Cooperate with regulatory obligations where required

Business continuity measures include:

• Regular backups
• Disaster recovery planning
• Operational continuity planning

Our objective is to minimize downtime and mitigate risk exposure.

7. Vendor & Sub-Processor Risk Management

We conduct due diligence before engaging third-party providers. Our vendor evaluation considers:

• Security posture
• Regulatory compliance
• Data processing safeguards
• Contractual confidentiality commitments

All Sub-Processors are bound by data protection obligations aligned with our DPA. For additional information, please refer to our Sub-Processor List.

8. Organizational Security

Security is not only technical - it is operational. We implement:

• Confidentiality agreements for personnel
• Access governance policies
• Internal data handling procedures
• Secure device and endpoint practices
• Defined escalation channels

Personnel access is revoked promptly upon role change or termination.

9. International Data Transfers

Where personal data is transferred across borders, SFL Tech ensures:

• Standard Contractual Clauses (SCCs) or equivalent safeguards and Compliance with GDPR Chapter V
• Appropriate contractual protections

10. Customer Collaboration

We recognize that security is a shared responsibility. SFL Tech works collaboratively with:

• CIOs and IT departments
• Compliance teams
• Security auditors
• Enterprise procurement

We provide documentation, assist in security questionnaires, and support client risk assessments.

11. Compliance Documentation

Upon request, SFL Tech can provide:

• Data Processing Addendum (DPA)
• Sub-Processor disclosures
• Privacy Policy
• Security overview documentation

Please contact: connectwithus@sfltech.ai

12. Continuous Improvement

Security threats evolve. So do we. We continuously review and improve:

• Access controls
• Monitoring mechanisms
• Risk management procedures
• Regulatory compliance alignment

Our goal is operational resilience and long-term trust.