Research Automators Sweden AB
Research Automators Sweden AB (“Research Automators”) is committed to protecting the confidentiality, integrity and availability of information entrusted to us.
This policy establishes the overall principles for information security within Research Automators and applies to our employees, systems, services, information assets and relevant third-party services.
Information security is an integrated part of our operations and is considered throughout the development, delivery and operation of our services.
Research Automators takes a risk-based approach to information security. Our objective is to prevent security incidents where reasonably possible and to minimise their impact through appropriate preventive, detective and recovery measures.
We recognise that effective information security depends on a combination of technology, processes and people. Security awareness and clearly defined responsibilities are therefore important parts of our information security management.
Everyone who handles information on behalf of Research Automators has a responsibility to protect it and to follow applicable security policies and procedures.
Employees are required to report suspected security incidents, vulnerabilities or other events that may affect the confidentiality, integrity or availability of information.
Specific responsibilities for systems, access rights, projects, security monitoring and incident management are assigned within the organisation.
Access to systems and information is granted according to business needs and the principle of least privilege.
Access rights are reviewed and adjusted when responsibilities change and are removed when access is no longer required.
Appropriate authentication and access controls are used to protect business-critical systems and information.
Research Automators applies appropriate technical and organisational measures to protect information against unauthorised access, disclosure, alteration, loss or destruction.
These measures include controls relating to authentication, encryption, secure communication, endpoint protection, system access and secure handling of information.
Additional safeguards are applied where required by the sensitivity of the information and the risks associated with its processing.
Research Automators relies on professional infrastructure and technology providers for parts of its IT environment.
Relevant suppliers are selected and managed with information security in mind. Their ability to provide the required level of security is assessed and monitored as appropriate.
Information security requirements are also considered when introducing new systems, services and suppliers.
Research Automators monitors its systems and services for security-related events and takes appropriate action when potential security issues are identified.
Technical security is regularly assessed through vulnerability management and security testing. In addition, an independent external penetration test of our platform is conducted annually, with identified findings assessed and addressed as appropriate.
Research Automators maintains procedures for identifying, reporting, assessing and responding to information security incidents.
Security incidents are investigated and appropriate corrective and preventive actions are taken.
Business continuity and recovery requirements are considered for business-critical systems in order to reduce the impact of significant disruptions or security incidents.
Personal data is handled in accordance with applicable data protection legislation and Research Automators’ Data Protection Policy.
Appropriate technical and organisational measures are applied to protect personal data throughout its processing.
Employees are informed of applicable information security requirements and are expected to understand their individual responsibilities.
Security awareness, internal instructions and working practices are reviewed as necessary to address changes in risks, technology and the organisation.
Research Automators regularly reviews information security risks, incidents, controls and relevant changes in our operating environment.
We continuously seek to improve our information security measures and incorporate relevant improvements into our management system, processes and services.
Compliance with this policy is mandatory for all personnel within its scope.
The policy is reviewed regularly and updated when necessary due to changes in risks, technology, legislation, our services or business operations.
Policy owner: Research Automators Sweden AB
Approved by: CEO
Version: 2025-02-13