Foregenix Trust Center

We earn our position as your trusted cybersecurity partner by relentlessly focusing on security, compliance and privacy.

privacy policy

foregenix-partners

Transparency is the foundation of trust

The Foregenix Trust Center offers real-time insight into our security posture, certified standards (ISO 27001:2022, Cyber Essentials), and the organisational controls we use to protect our customer data every single day

 

Our approach to security

Fundamental security policy principles (from our Information Security Policy)

Confidentiality

Foregenix shall protect information from unauthorised access or disclosure

Integrity

Foregenix shall ensure information is accurate, complete, and protected from unauthorised changes

Availability

Systems and data must be kept available to authorised users as needed

Least Privilege - Need to Know

People must have only what access is strictly necessary to perform their role, applying role-based access control (RBAC) to keep permissions appropriate and limited

Segregation of Duties

Critical tasks are divided among multiple people to prevent fraud or error, and where this is impractical, compensating controls such as independent review or auditing are used

Legal & Contractual Compliance

Foregenix systematically identifies and follows all applicable laws, regulations, and customer requirements

Asset Management

Foregenix identifies, classifies, and protects information assets according to their value and sensitivity, ensuring they are properly managed throughout their lifecycle

Data protection & Privacy

Foregenix protects personal data and respect privacy in accordance with laws and good practices

Risk Management

Information security risks are identified, assessed and addressed in a structured way

Incident Management

Foregenix promptly identifies, report, and respond to security incidents to minimise impact and learn from events

Vulnerability and Patch Management

We conduct periodic vulnerability assessments and penetration testing of our systems. Critical vulnerabilities are remediated in 48 hours

Business Continuity

Foregenix maintains  plans to recover from disruptions and protect services and data according to the specific needs and criticality of each case. Operating as a 100% remote organisation enhances our operational resilience by removing reliance on centralised physical infrastructure or traditional office spaces. Our fully distributed model, supported by cloud-native services and secure remote management frameworks, enables seamless continuity of operations during regional disruptions or emergencies

Change Management

Foregenix manages changes to systems, processes, and services in a controlled way to reduce security risks and prevent unintended disruptions

Accountability & Records

We document activities with a security impact  through logs, tickets, and other records to ensure accountability, support investigations, and demonstrate compliance. These records are reviewed and audited to confirm their accuracy and effectiveness

Awareness & Responsibility

Everyone in Foregenix is responsible for protecting information and must comply with our internal security policies, legislative, regulatory and compliance obligations

Continuous Improvement

Foregenix regularly reviews and improves its security practices

CONTROLS IN PLACE

People Controls

Our people are the cornerstone of our information security defenses. Foregenix maintains rigorous organisational and personnel controls to ensure that all staff members, contractors, and third parties adhere to the highest standards of integrity, competence, and security awareness:

  • Expert Security Personnel: Foregenix staff are highly skilled IT security professionals, including recognised lead figures and industry experts who drive our operational excellence and security governance
  • Pre-Employment Screening & Background Checks: Comprehensive background and criminal verification checks are mandatory for all candidates, contractors, and third-party users prior to onboarding and at regular intervals aligned with role sensitivity and legal requirements
  • Confidentiality & Non-Disclosure Agreements: All personnel are required to sign strict Non-Disclosure Agreements (NDAs) and formal confidentiality commitments upon hire to safeguard client and corporate data
  • Onboarding & Continuous Security Awareness Training: Mandatory information security awareness training is conducted during onboarding and reinforced annually. This includes targeted modules, phishing simulations and regular outreaches to ensure continuous vigilance

Technical Controls

  • All our infrastructure is cloud based (Amazon Web Services and Google), ensuring top physical controls  and a backend up to par with the strictest compliance and sovereignty requirements (AWS Trust Center/Google Cloud Trust Center)
  • Data at rest is encrypted using AES-256, data in transit is encrypted using TLS 1.2+
  • MFA is enforced  across all internal systems
  • Our infrastructure undergoes weekly automated vulnerability scanning and quarterly penetration testing
  • Our server instances and end-user laptops are hardened according to CIS Level 1 and industry best practices
  • Critical data is backed up with AWS backup in compliance mode, meaning no one (not even AWS) can tamper with a backup's contents or lifecycle
  • Our publicly facing web endpoints are protected against DDoS with AWS Shield, and against malicious requests with AWS WAF
  • We never use production data in testing or development environments

Our Certifications

Our Commitment to our Clients
ISO 27001:2022

 

View Certificate
Cyber Essentials

 

View Certificate

We know that privacy plays a critical role in earning and maintaining your trust

Data Privacy policy

Data Privacy

Foregenix conforms to the UK/EU GDPR and other local legislations.  We maintain a strict "Privacy by Design" framework. We do not harvest personal data for secondary commercial purposes, targeted advertising, or automated profiling. All data processed within our environment is strictly limited to what is necessary to fulfill our contractual obligations, maintain operational integrity, and meet regulatory requirements.

Our subprocessors:

 google-logo-icon-symbol-free-png          logo-aws

 

IT Security operations and monitoring

A dedicated Global Support and Security Operations team combining SOC monitoring, incident response, and infrastructure management

Bringing together decades of hands-on cybersecurity experience, the team maintains 24/7/365 threat vigilance across endpoint, cloud, and network environments.

Operates as a unified function under the direct leadership of the Information Security Officer to ensure continuous monitoring, rapid incident handling, automated baseline drift detection, and proactive threat hunting aligned with ISO 27001 standards.