Information Security Statement

1. Scope

This statement covers the VYKN website and digital platforms, learning management systems, information processed for clients, partners and users, and staff, contractors and authorised third parties. It applies to personal data, confidential business information and proprietary content.

2. Governance and accountability

Senior management oversees information security risk and ensures policies and controls are maintained. Responsibilities are assigned by role and access need, following the principle of least privilege.

3. Risk-based approach

Controls are based on the sensitivity and criticality of information, legal and regulatory requirements, threat and vulnerability assessments and business needs. Risks are reviewed periodically.

4. Technical and organisational measures

• Access control: authentication, multi-factor authentication for administrative access, and role-based access management.
• Encryption: data in transit, and at rest where appropriate.
• Monitoring: network security controls, logging, monitoring and incident detection.
• Configuration: secure configuration, patch management and segregation of environments where appropriate.
• Hosting: platform data is hosted in the United Kingdom with a provider holding independent security attestations.

5. Data protection alignment

Controls are aligned with data protection and privacy obligations. Access to personal data is limited to authorised individuals who need it for their duties.

6. Third-party and supplier security

We perform due diligence on providers that may process or access information. Providers must implement appropriate security measures and are bound by contractual confidentiality and security obligations.

7. Testing

Threat and vulnerability assessments are carried out periodically, and independent penetration testing and an infrastructure audit are scheduled following platform launch.

8. Incident management

Procedures cover detection and reporting, containment and remediation, impact and root-cause assessment, and notification where law or contract requires it. Incidents are reviewed for improvement.

9. Business continuity and resilience

Data backup and recovery, redundancy where appropriate, and business continuity and disaster recovery planning.

10. Awareness and training

People with system access receive guidance on their security responsibilities, aimed at reducing human error.

11. Continuous improvement and updates

Controls, policies and procedures are reviewed and improved over time. This statement may be updated; the current version is posted on the website.

12. Contact

Questions: contact@vykn.com. To report a suspected security incident affecting VYKN systems or data, email contact@vykn.com with "Security" in the subject line.