Skip to content

Revzio — Information Security & Privacy Documentation

This directory is the source of truth for Revzio's information security and data privacy policies, standards, and procedures. Documents are authored in Markdown, version-controlled in git, and approved through pull-request review (the PR approval serves as the management sign-off record). Customer-facing copies are exported to PDF and shared under NDA, and (in future) published to a gated Trust Center.

Conventions

  • Classification: Internal unless marked otherwise. Policies may be shared with customers and auditors under NDA.
  • Ownership: Each document names an owner responsible for keeping it current.
  • Review cadence: All documents are reviewed at least annually, or on significant change.
  • Approval: Recorded in the document's revision table; the merging of the PR that introduces or changes a document constitutes management approval.

Document index

# Document Backs questionnaire items
00 Information Security Policy (master) Sno 1, 6, 7, 10, 11
01 Data Privacy & Protection Policy Sno 2, 16, 17, 18, 19, 20, 22
02 Access Control Policy Sno 36, 37, 38, 39, 40
03 Password & Authentication Policy Sno 39, 40
04 Encryption & Key Management Policy Sno 21, 23, 24
05 Data Retention & Disposal Policy Sno 25, 26, 27
06 Acceptable Use Policy Sno 71, 75
07 BYOD & Endpoint Security Policy Sno 48, 49, 50, 51
08 Vulnerability Management Policy Sno 28, 29, 30
09 Network Security Policy Sno 31, 32, 33, 34, 35
10 Logging & Monitoring Policy Sno 42, 43, 44, 45, 46, 47
11 Third-Party / Vendor Risk Management Policy Sno 8, 20
12 Change Management Policy Sno 68
13 Secure SDLC Policy Sno 65, 66
14 HR Security Policy Sno 61, 62, 63, 64
15 Security Awareness & Training Policy Sno 58
16 Asset Management Policy Sno 9, 13
17 Threat Intelligence Policy Sno 41
18 Incident Response Plan Sno 72
19 Business Continuity & Disaster Recovery Policy Sno 73, 74, 75
20 Subprocessor Register Sno 8, 20, 24

Status

Initial draft set authored 2026-06-11 to support the CoinDCX third-party security review. Items marked "(planned)" within documents describe controls on the near-term roadmap; they are called out honestly rather than overstated. See .dev/tasks/backlog/ for the tracked work to close those gaps.