Handbook
Gradient Handbook / Operations & HR / Data Privacy & Security / Data Security Policy Edit this page

Data Security Policy

Introduction

To ensure the security of company and client information, as well as to comply with multiple Data Processing Agreements we have with clients, Gradient uses the following data security tools: NordLayer, NordPass, and ESET.

The purpose of this page is to clarify the policies for each data security tool. Please follow these rules!

VPN: NordLayer

It is the responsibility of Gradient staff to enable the VPN to comply with the following policies:

  • While traveling and/or on open networks

  • When accessing production environments, email systems (Gradient Gmail), or services that access, process, or store client data (Crunch, AWS, etc.)

  • When on private home network and not accessing production environment, email system, or services that access, process, or store client data

Password Management: NordPass

Many of these policies will be set on the admin side of NordPass and will force you to follow them when using the tool. However, please be aware of these policies so you have an understanding of why you are being “forced” to create passwords of a certain length, change your passwords at a regular cadence, etc. Passwords must follow the Password Policy.

Password management platform will maintain and enforce “account lockout” by disabling accounts with access to client information when an account exceeds more than ten (10) consecutive incorrect password attempts

Antivirus: ESET

This is a great tool to protect both Gradient data and your personal data. Unlike the VPN tool, the ESET antivirus software should run at all times on your laptop. The reason for this is even if you are not working with Gradient data, any breach or virus will affect your entire computer and anything you access. The policies are as follows:

  • All computer devices that access Gradient company or client-related data shall have anti-virus software installed, running, and configured so that the virus definition files are current and are routinely and automatically updated

  • The virus protection software must not be disabled

  • The automatic update frequency of the virus protection software must not be altered to reduce the frequency of updates

  • All files on computer devices will be scanned periodically for malware

  • Every virus that is not automatically cleaned by the virus protection software constitutes a security incident and must be reported to the Data Protection Officer