Third-Party Platforms

MFC Safe Pty Ltd

Third-Party Platform Compliance Policy

---

1. Policy Overview

MFC Safe relies on a secure and resilient software infrastructure composed of trusted third-party platforms. This policy defines our compliance standards, selection criteria, and verification methods for all integrated service providers used in the Didge platform and broader digital ecosystem.

---

2. Policy Statement

MFC Safe mandates that all core third-party service providers supporting our platform operations must meet internationally recognized standards for information security, privacy, availability, and data integrity.

Minimum Requirements:

• Must hold valid and current ISO/IEC 27001 certification (Information Security Management System – ISMS).

• Must provide independent validation of security practices via public or client-accessible certification reports (e.g. SOC 2, ISO 27701, ISO 27017, ISO 9001).

• Must support advanced technical controls aligned with MFC Safe’s security model (e.g. data encryption, audit logs, disaster recovery, and access control).

---

3. Core Third-Party Platforms in Use

Amazon Web Services	ISO 9001, ISO 27001, ISO 27017, ISO 27018, ISO 27701	DOOS encryption, IAM controls, VPC isolation, audit logging
MongoDB, Inc.	ISO 9001, ISO 27001	Daily backups, TLS encryption, replica sets, IP whitelisting
GitHub	ISO 27001	SSO, repo-level permissions, secure code scanning
Cloudflare	ISO 27001	WAF, DDoS protection, TLS termination, edge cache security
Sentry	ISO 27001	Encrypted event storage, RBAC, alerting
Auth0	ISO 27001, ISO 27017, ISO 27018	MFA, user role management, token encryption
Google LLC	ISO 9001, ISO 27001	Endpoint security, app engine isolation, data residency
OpenAI	SOC 3	Data confidentiality, service-level security controls
Twilio, Mailgun	ISO 27001, ISO 27701	Secure messaging, API traffic controls, GDPR compliance

---

4. Compliance Verification Matrix

Policy Area	Purpose	Assessment Criteria	Demonstrated Evidence / Controls
Information Security (ISMS)	Protect platform and client data	ISO/IEC 27001 Certification, access controls, encryption in transit and at rest	AWS, MongoDB, Google Cloud, Auth0, Mailgun, Sentry
Privacy Controls (PII/PIMS)	Align with GDPR, PDPA, privacy frameworks	ISO 27701, data minimization, deletion protocols	Auth0, Mailgun, OpenAI, AWS Privacy docs
Cloud Security (ISMS ext.)	Secure SaaS operations & infrastructure	ISO 27017, SOC 2, cloud audit tools, VPC, MFA	AWS, Cloudflare, Google Cloud, Sentry
Quality Management	Align operations with QMS and incident response	ISO 9001, CI/CD traceability, change control	AWS, MongoDB, Google, GitHub
Encryption & Backups	Secure critical platform data	Daily/weekly backup policies, TLS, encryption-at-rest	MongoDB backups, AWS DOOS, Cloudflare cache TLS
Vendor Certification Status	Standardized vendor selection	Vendor must be ISO 27001 certified or equivalent	Included in onboarding/vendor due diligence
Third-Party Risk Controls	Validate that vendor meets baseline security posture	Publicly listed certifications, policy documents, DR policy, audit history	Supplier-provided certificates (see links)

---

5. Certification Registry Reference

All certificates are logged and verified. Refer to attached registry [Third-Party Certification Matrix] for:

• Certificate type (e.g. ISO/IEC 27001:2022)

• Supplier name and compliance category

• Expiry date and verification link

---

6. Policy Enforcement

This policy is reviewed annually. Any third-party found non-compliant may be flagged for reassessment, migration, or deprecation. New vendors are screened against these criteria before platform integration.

Non-negotiable clause:

MFC Safe requires that any core infrastructure partner must be certified under ISO/IEC 27001:2013 or later.

---

7. Document Control

Owner: Technology Director, MFC Safe Pty Ltd

Effective Date: 2 April 2025

Next Review Date: 2 April 2026

Version: 1.0

---

End of Policy