• Applies to staff, contractors, and systems we use for client work.
• Covers data in our control. Client platforms you own follow your rules.
• Goals: keep confidentiality, integrity, and availability; meet legal duties; cut risk.

• Director (Security Lead): policy owner and risk decisions.
• Project Leads: apply controls on each engagement.
• All personnel: follow this policy; report incidents fast.

We avoid special category data. If needed, we add controls in the SoW.

• MFA on all admin and code repos.
• Least-privilege roles; access reviews every 90 days.
• Joiner/mover/leaver steps with same-day removal on exit.
• Passwords: 12+ characters; password manager required.

• Company devices only for client credentials.
• Disk encryption enabled; auto-lock at 5 minutes.
• OS and browsers patch to current release within 14 days.
• Anti-malware and DNS filtering active.

• TLS for data in transit; HTTPS everywhere.
• Hardened hosts; limited inbound rules; keys rotated on change.
• Backups for hosted components; restore tests at least twice a year.

• Secrets kept outside code and CI logs.
• Code review for risky changes; non-prod testing before live.
• Dependencies scanned; pin versions; remove unused packages.

• Health checks on workflows and endpoints.
• Alert on failures, unusual latency, and job queues.
• Log retention: 30–90 days by default (per client risk).

• Critical patches within 7 days; high within 14 days.
• Monthly dependency updates; emergency hotfix path in place.

1. Detect: alerts or reports to the Security Lead.
2. Contain: revoke keys, isolate hosts, switch to backups.
3. Eradicate/Recover: fix, restore, validate.
4. Notify: clients without undue delay if personal data is affected (per the DPA).
5. Review: capture causes and actions.

• Target RTO 8 hours for hosted n8n; RPO 24 hours unless your SoW sets different targets.
• Documented rollback for key workflows.

• Use reputable providers; short retention where practical.
• Review data locations and terms. Live list at /sub-processors.

• Induction security briefing for all personnel.
• Annual refresh covering phishing, handling data, and incidents.

• Data maps and SoW notes record where personal data flows.
• Retention follows our Privacy Policy and project needs.

• Policy review at least yearly or after major changes.
• Breaches of this policy may lead to access removal or contract action.

Questions about this policy?

Technophobia Ltd · Company No. 14898332 · VAT GB 495 7043 58
13B Devonshire Road Industrial Estate, Millom, LA18 4JS, United Kingdom
+44 1229 774591 • hello@technophobia.uk