Information Security Policy

Last updated: 24/08/2026

This is a translation provided for convenience. In the event of any discrepancy, the Portuguese version prevails.

1. Purpose

This policy sets out the principles and measures Apollotec adopts to protect the confidentiality, integrity and availability of the information it processes, whether its own, its clients' or its partners'. It is also the answer to Article 32 GDPR — the technical and organisational measures appropriate to the risk — to which the Privacy Policy refers.

2. Scope

It applies to all Apollotec information systems, infrastructure, staff, service providers and processes involved in processing, storing or transmitting information, including the cloud and hosting services Apollotec manages for its clients.

3. Principles

Confidentiality — information is accessed only by those authorised and with a legitimate need to know.
Integrity — information stays accurate and complete, protected against unauthorised alteration.
Availability — information and systems are accessible whenever needed, within the agreed service levels.

4. Technical measures

Access control on the least-privilege principle, with individual authentication and multi-factor authentication on administrative access;
Encryption of sensitive data, in transit and at rest;
Regular backups, with periodic restore testing;
Continuous infrastructure monitoring and anomaly detection;
Activity logging of administrative access, for traceability;
Vulnerability management and regular application of security updates;
Perimeter protection and anti-DDoS systems in our data centres;
Segregation of development, test and production environments;
Security across the development lifecycle: code review, input validation and HTTP security headers on the sites we publish.

5. Organisational measures

Contractual confidentiality duties for staff and service providers;
Periodic team awareness training on information security and data protection;
Article 28 GDPR processing agreements with every provider processing data on our behalf;
Security assessment of providers before award;
Access revocation at the moment duties or the contract end;
Minimisation: we collect and keep only what the purpose requires, for as long as the purpose requires.

6. Certifications and compliance

Our data centres operate under ISO 27001 certification and are located in the European Union. Internal processes are designed for compliance with the GDPR, with Portuguese Law no. 58/2019 and with other applicable legislation in Portugal and the European Union.

7. Security incident management

We maintain a formal process for detecting, containing, responding to, resolving and reviewing security incidents.

Where a personal data breach is involved, and under Articles 33 and 34 GDPR:

We notify the Comissão Nacional de Proteção de Dados within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to the rights and freedoms of data subjects;
We inform the affected data subjects without undue delay where the breach is likely to result in a high risk;
Where we act as a processor, we inform the controller client without undue delay, so it can meet its own notification duties;
We keep an internal record of all breaches, including those that are not notifiable, with their effects and the corrective measures taken.

8. Continuity

Backups and recovery procedures are tested periodically, so that service restoration is not verified for the first time during an incident.

9. Responsibilities

All Apollotec staff and service providers are responsible for complying with this policy and for immediately reporting any incident or suspected incident.

10. Responsible vulnerability disclosure

If you find a vulnerability in our systems, write to info@apollotec.pt with a description and reproduction steps. We ask that you do not publicly disclose the flaw before we have had a chance to fix it, and that you do not access, alter or exfiltrate third-party data while testing. We respond to every report.

11. Review of this policy

This policy is reviewed periodically, and whenever there is a material change in our processes, in the technology used or in applicable legislation.

12. Contact

To report a security incident or a vulnerability, or for any question about this policy, contact info@apollotec.pt.

1. Purpose

3. Principles

Confidentiality — information is accessed only by those authorised and with a legitimate need to know.

Integrity — information stays accurate and complete, protected against unauthorised alteration.

Availability — information and systems are accessible whenever needed, within the agreed service levels.

4. Technical measures

Access control on the least-privilege principle, with individual authentication and multi-factor authentication on administrative access;

Encryption of sensitive data, in transit and at rest;

Regular backups, with periodic restore testing;

Continuous infrastructure monitoring and anomaly detection;

Activity logging of administrative access, for traceability;

Vulnerability management and regular application of security updates;

Perimeter protection and anti-DDoS systems in our data centres;

Segregation of development, test and production environments;

Security across the development lifecycle: code review, input validation and HTTP security headers on the sites we publish.

5. Organisational measures

Contractual confidentiality duties for staff and service providers;

Periodic team awareness training on information security and data protection;

Article 28 GDPR processing agreements with every provider processing data on our behalf;

Security assessment of providers before award;

Access revocation at the moment duties or the contract end;

Minimisation: we collect and keep only what the purpose requires, for as long as the purpose requires.

7. Security incident management

We maintain a formal process for detecting, containing, responding to, resolving and reviewing security incidents.

Where a personal data breach is involved, and under Articles 33 and 34 GDPR:

We notify the Comissão Nacional de Proteção de Dados within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to the rights and freedoms of data subjects;

We inform the affected data subjects without undue delay where the breach is likely to result in a high risk;

Where we act as a processor, we inform the controller client without undue delay, so it can meet its own notification duties;

We keep an internal record of all breaches, including those that are not notifiable, with their effects and the corrective measures taken.

10. Responsible vulnerability disclosure