1. Purpose

This policy establishes the security controls and practices CloudFive uses to protect the confidentiality, integrity, and availability of client data and systems. It applies to all services delivered by CloudFive and all systems, devices, and accounts used in the delivery of those services.

2. Scope

This policy applies to all CloudFive systems, cloud environments, client data, and third-party integrations used during an engagement. It covers all delivery personnel operating under the CloudFive umbrella.

3. Information Classification

• Confidential: Client data, credentials, proprietary business logic, NDA-covered materials. Must be encrypted at rest and in transit. Access restricted to need-to-know.
• Internal: Operating procedures, tooling configuration, internal communications. Not for public disclosure.
• Public: Marketing materials, open-source repositories, published case studies (with client consent).

4. Access Control

• All cloud console access uses MFA (TOTP or hardware key). Passwords not used without MFA.
• IAM roles follow least-privilege; no standing admin access. Elevated roles are assumed temporarily via AWS IAM role assumption and logged.
• SSH access to servers uses key-based authentication only. Root login is disabled.
• Client credentials (API keys, secrets) are stored in AWS Secrets Manager or equivalent secret store — never in source control or plaintext files.
• Access to client systems is revoked within 24 hours of engagement close.

5. Endpoint Security

• Primary development machine runs macOS with FileVault full-disk encryption enabled.
• OS and software patches are applied within 30 days of release; critical patches within 7 days.
• Screen lock activates after 5 minutes of inactivity.
• No client data is stored on local disk beyond the active engagement window. Data is purged or returned at engagement close.

6. Network Security

• All client work is performed over a secured home office network with WPA3 or equivalent. Public Wi-Fi is avoided; VPN is required if used.
• AWS VPCs are used to segment environments. Security groups follow deny-by-default.
• All data in transit uses TLS 1.2 minimum. TLS 1.3 preferred for new deployments.

7. Data Handling

• Client production data is not used in development or test environments without explicit written consent.
• Backups of client data are encrypted using AES-256 and stored in isolated AWS S3 buckets with versioning enabled.
• Data retention follows the terms of the engagement contract. Default: 90 days post-engagement, then permanent deletion.

8. Third-Party & Subprocessors

Third-party services used in client engagements are documented in the Subprocessor List (Policy 6). CloudFive does not share client data with third parties except as required to deliver the agreed scope of work. All third-party tools are reviewed for SOC 2 compliance or equivalent prior to use with client data.

9. Policy Review

This policy is reviewed annually and updated within 30 days of any material change in infrastructure, tooling, or regulatory requirements.

10. Contact

Security inquiries: todd@cloudfive.net

1. Purpose

This document describes how CloudFive collects, uses, stores, protects, and deletes data belonging to clients, their customers, and other third parties. CloudFive's default position is data minimization: we access and retain only what is necessary to deliver the agreed scope of work.

2. Data Categories Processed

3. Data Collection

• CloudFive collects only the minimum data required to complete the engagement.
• Access to client production systems requires explicit written authorization per engagement.
• Any access to end-user PII requires a signed Data Processing Agreement (DPA) prior to engagement start.

4. Data Storage

• All client data in CloudFive's custody is stored in AWS (us-east-1 or us-east-2 by default, unless client specifies otherwise).
• Data at rest is encrypted with AES-256 (AWS managed keys, or CMKs for sensitive engagements).
• Data in transit uses TLS 1.2+.
• No client data is stored in personal cloud storage or unencrypted local disk.

5. Data Access

• Client data is accessed only by CloudFive personnel with a need-to-know for the engagement.
• Access logs are retained for 90 days minimum in AWS CloudTrail.
• Sub-contractors are not granted access to client data without prior written client consent.

6. Data Retention & Deletion

• During engagement: Data is retained as required to deliver services.
• Post-engagement default: 90 days, then permanent deletion.
• On client request: Deletion within 10 business days. Certificate of deletion provided upon request.
• Legal hold: Data may be retained longer if required by law or litigation.

7. Data Sharing

CloudFive does not sell, rent, or share client data. The only permitted disclosures are subprocessors necessary to deliver the service, legal requirements (client notified where legally permissible), and client-directed sharing.

8. Breach Notification

In the event of a confirmed data breach affecting client data, CloudFive will notify affected clients within 72 hours of confirmation. Notification will include the nature of the breach, data affected, mitigation steps taken, and recommended client actions.

9. Contact

Data handling inquiries: todd@cloudfive.net

1. Purpose

This policy defines how CloudFive detects, responds to, and recovers from security incidents affecting client data or CloudFive systems.

2. What Constitutes an Incident

• Unauthorized access to CloudFive or client systems
• Data breach or suspected exfiltration of client data
• Malware or ransomware on CloudFive endpoints
• Credential compromise (phishing, account takeover)
• Availability disruption to client-facing infrastructure
• Accidental exposure of sensitive data (misconfigured S3 bucket, leaked key)

3. Incident Severity

• P1 — Critical: Active breach, confirmed data exfiltration, ransomware. Response: within 1 hour.
• P2 — High: Suspected breach, credential compromise, significant availability loss. Response: within 4 hours.
• P3 — Medium: Anomalous activity, potential exposure. Response: within 24 hours.
• P4 — Low: Policy violation, failed intrusion attempt. Response: within 5 business days.

4. Response Phases

5. Client Notification

• P1/P2 incidents affecting client data: initial notification within 72 hours of confirmation.
• Follow-up full incident report provided within 14 days.
• CloudFive will cooperate fully with client forensic investigations.

6. Contact

To report a suspected incident: todd@cloudfive.net with subject line [SECURITY INCIDENT].

1. Purpose

This policy defines how CloudFive identifies, prioritizes, remediates, and tracks security vulnerabilities in its systems and the client environments it manages.

2. Vulnerability Sources

• AWS Inspector — continuous scanning of EC2, Lambda, and container images
• AWS Security Hub — aggregated findings from GuardDuty, Config, Inspector, and Macie
• Dependabot / npm audit / pip-audit — dependency scanning in CI/CD
• macOS system update notifications — endpoint OS/app patching
• CVE feeds (NIST NVD) — manual tracking for critical libraries

3. Severity & Remediation SLAs

4. Patching Procedures

• OS patches reviewed weekly, applied within 30 days. Critical patches within 7 days.
• Application dependencies: npm audit fix or equivalent run before each deployment and in CI.
• Container base images rebuilt from latest upstream monthly, or within 7 days of a critical CVE.
• AWS Lambda runtimes reviewed quarterly; deprecated runtimes migrated before AWS end-of-support date.

5. Responsible Disclosure

To report a vulnerability: todd@cloudfive.net with subject [VULNERABILITY REPORT]. We acknowledge within 2 business days and request a 90-day coordinated disclosure window.

1. Purpose

This policy defines how CloudFive maintains service continuity and recovers from disruptive events including infrastructure failures, data loss, and personal incapacitation. Given CloudFive's structure as a single-operator consultancy, this policy prioritizes transparency with clients when disruptions occur.

2. Recovery Objectives

3. Backup Strategy

• AWS RDS / databases: Automated daily snapshots retained for 30 days. Point-in-time recovery enabled.
• S3 data: Versioning enabled on all client data buckets. Cross-region replication for critical buckets.
• Infrastructure as code: All infrastructure defined in Terraform/CDK, committed to Git. Environment can be rebuilt from code.
• Credentials: Stored in 1Password with emergency kit secured offline.
• Development laptop: Time Machine to encrypted local drive + cloud backup. RPO: daily.

4. Scenario Responses

• AWS region outage: Restore from snapshots in secondary region. Estimated RTO: 4 hours.
• Data corruption: Restore from versioned S3 or RDS snapshot to the last known-good state.
• Ransomware: Isolate affected systems. Restore from immutable backups (S3 Object Lock where applicable). Do not pay ransom.
• Operator incapacitation (illness, emergency): Client is notified within 24 hours. A documented handoff procedure covers repository access, credential recovery, and in-flight work status so engagements can be transitioned or paused without data loss.

5. Client Notification

CloudFive will notify affected clients within 4 hours of any disruption expected to exceed 2 hours for P1 clients, or 24 hours for P2/P3 engagements. Status updates every 2 hours until resolved.

6. Contact

Todd Densmore — todd@cloudfive.net

The following third-party services may be used in the delivery of CloudFive engagements. Client data is shared with a subprocessor only where required to deliver the agreed scope of work. CloudFive does not use subprocessors for advertising or data monetization.

Infrastructure & Compute

AI & LLM Services (when applicable)

Communication & Productivity

Security & Operations

Change Notification

CloudFive will provide 30 days advance notice before adding a new subprocessor that will process client personal data. Contact: todd@cloudfive.net