Skip to content

Information Security Policy

Field Value
Owner Puneet Gupta (Co-Founder)
Classification Internal (shareable under NDA)
Version 1.0
Effective date 2026-06-11
Last reviewed 2026-06-11
Next review 2027-06-11 (at least annually)

1. Purpose

This policy establishes Revzio's overarching commitment to protecting the confidentiality, integrity, and availability of information entrusted to it — including customer data processed by the Pixis FinOps platform — and sets the framework under which all other security and privacy policies in this directory operate.

2. Scope

Applies to all personnel (employees, contractors, and third parties), all systems used to deliver the Pixis service, and all customer and company data processed, stored, or transmitted by Revzio.

3. Framework alignment

Revzio's information security program is aligned to the principles of ISO/IEC 27001 and the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover). Formal certification (SOC 2 / ISO 27001 / ISO 27701) is on the roadmap and tracked separately.

4. Policy statements

  1. Risk-based approach. Security controls are selected and prioritized based on the risk to customer data and the business.
  2. Least privilege. Access to systems and data is granted on a need-to-know basis and the minimum necessary to perform a role. (See Access Control Policy.)
  3. Defense in depth. Multiple layers of control protect data — encryption, tenant isolation, network controls, logging, and monitoring.
  4. Data protection by design. Privacy and security requirements are considered in the design of features and integrations. (See Secure SDLC Policy.)
  5. Accountability. Every policy has a named owner; every significant security decision is recorded.
  6. Continuous improvement. Controls and policies are reviewed at least annually and after significant incidents or changes.

5. Roles & responsibilities

  • Management / Security Lead — owns the security program, approves policies, allocates resources, and is the escalation point for incidents.
  • Engineering — implements and operates technical controls; follows secure development practices.
  • All personnel — comply with these policies, complete security training, and report suspected incidents.

6. Policy governance

  • Policies are stored in docs/security/, version-controlled, and changed via pull request.
  • The merge of a reviewed PR constitutes management approval and is the audit record.
  • Policies are reviewed at least annually; the review date is recorded in each document.
  • Material changes are communicated to all personnel.

7. Compliance & exceptions

Non-compliance may result in disciplinary action up to termination (see HR Security Policy). Exceptions must be documented, risk-assessed, time-bound, and approved by the Security Lead.

Revision history

Version Date Author Change Approved by
1.0 2026-06-11 Puneet Gupta Initial draft Puneet Gupta (Co-Founder)