1. Governance

SONO applies risk-based security governance, assigned responsibilities, documented procedures, periodic review and continual improvement.

2. Identity and access

• Unique user identities and role-based permissions
• Least privilege and timely access removal
• Strong authentication for privileged administration
• Logging and review of security-relevant access

3. Application and infrastructure

• Secure development and change controls
• Vulnerability, patch and configuration management
• Encryption in transit and appropriate encryption at rest
• Environment separation, monitoring and alerting

4. Resilience

SONO maintains backup, restoration and incident-response processes with service objectives documented in the SLA and DPA.

5. People and suppliers

Personnel with access are bound by confidentiality and receive appropriate awareness. Service providers are assessed and contractually required to protect relevant data.

6. Reporting concerns

Security concerns should be sent to info@sonosoftware.com with sufficient technical detail.