Security Compliance
MFC Safe Pty Ltd Security Compliance & Risk Policy Version: 1.0 Effective Date: 2 June 2025 Next Review Date: 2 June 2026
1. Purpose
This policy outlines MFC Safe's approach to managing security risks, maintaining compliance with internationally recognized standards, and preparing for audit and certification processes. It applies to all personnel, systems, and data managed by or on behalf of MFC Safe.
2. Compliance Objectives
Maintain full alignment with ISO/IEC 27001, ISO 27017, ISO 27018, SOC 2, and GDPR standards
Uphold customer and internal trust by safeguarding systems, data, and access pathways
Enable audit readiness through logging, reporting, and evidence-based practices
3. Data Handling & Privacy
All customer and internal data is classified and stored based on sensitivity
Data in transit is encrypted using TLS 1.2+, and data at rest using AES-256
Personally identifiable information (PII) is stored in-region as per customer configuration and privacy regulations
MongoDB Atlas and AWS services enforce in-region backups and automated retention policies
4. Access Control & Identity Management
Principle of Least Privilege (PoLP) enforced across all services
Role-based access control (RBAC) for users, administrators, and system services
Identity and authentication services are powered by Auth0 (MFA, OAuth 2.0)
Administrative operations require time-bound tokens and are audited
5. System & Infrastructure Security
Infrastructure hosted on Amazon Web Services (AWS) with hardened network configurations
Perimeter protection using Cloudflare WAF and DNSSEC
Audit trails managed via AWS CloudTrail, CloudWatch, and internal audit logs
Source code repositories secured via GitHub with SSO, branch protection, and dependency scanning
6. Certification & Vendor Assurance
MFC Safe’s platform is built using third-party providers who are ISO 27001 and/or SOC 2 certified (AWS, MongoDB, Cloudflare, GitHub, etc.)
A registry of supplier certifications is maintained and reviewed annually
New vendors must meet ISO 27001 or equivalent security certifications to be approved
7. Audit Readiness & Testing
Quarterly internal security and privacy audits
Penetration testing of web and infrastructure assets at least annually
Incident response simulations and table-top exercises conducted quarterly
All incidents logged and reviewed under our Incident Response Policy
Maintained By: Security & Compliance Lead Contact: technology@mfcsafe.com Approved By: Technology Director, MFC Safe Pty Ltd
End of Policy
Last updated
Was this helpful?