Identity and access
AMLOK uses individual accounts, least-privilege access, and separation of ordinary and privileged operations. Staff and privileged access use multifactor authentication. Access is approved for a defined purpose, reviewed when responsibilities change, and revoked when no longer required. Production support access is limited to authorized personnel, bounded by purpose and time, and recorded. Emergency access requires a separate review. Service identities and credentials are scoped to their functions, with secrets kept outside application code and customer-facing content. Customer authentication options, roles, and administrator permissions are confirmed during onboarding for your deployment.Encryption and key management
AMLOK encrypts restricted information in transit and at rest, including relevant databases, object stores, and backups. Key administration is separated from ordinary data access. Production and non-production environments use separate credentials and access boundaries. Your security review can cover the deployment’s transport protection, encryption mechanisms, key management, rotation rules, and recovery arrangements. Agree the configuration details and supporting evidence needed during due diligence.Tenant and environment separation
AMLOK checks authorization at tenant boundaries. Isolation testing covers requests, storage, search indexes, queues, caches, exports, logs, and backups. Development and demonstrations use synthetic or appropriately approved masked data. Infrastructure controls include restricted database access, controlled network paths, protected storage, monitored configuration changes, and outbound-access limits. Configuration reviews address the deployed environment and its dependencies.Secure development
The development process includes peer review, automated checks, dependency and secret scanning, controlled releases, and records of material changes. Vulnerabilities are prioritized by severity, exploitability, exposure, and customer impact. AMLOK’s vulnerability-management policy defines remediation targets and exception procedures. Customer-specific service commitments are set out in the agreement. Where independent testing has been performed, review its scope, date, findings, and remediation against the service and version assessed.Logging and monitoring
Security records support investigation of authentication, privilege changes, data access, exports, configuration changes, and material workflow actions. Logs are access-controlled and protected from unauthorized alteration, with sensitive payloads minimized. Operational procedures assign alert ownership, escalation, log retention, and review responsibilities. Investigations distinguish model-generated observations from verified security events and findings.People and suppliers
The security program includes confidentiality obligations, security awareness, access lifecycle procedures, and supplier reviews, with designated responsibilities. Incident-response procedures include exercise planning and follow-up on identified improvements. Use due diligence to agree the evidence needed. See incident response for investigation and recovery procedures.Web-application safeguards
The published application security policy describes these safeguards for app.amlok.io. Review the relevant architecture and configuration separately for an enterprise API or dedicated deployment.
See privacy and data handling for privacy requests and policies, and hosting and subprocessors for the provider register.