Trust & Assurance
Security
Security is integrated into how AF-X designs, develops and operates its technology, with controls applied according to service context and risk.
01Security approach
AF-X uses a risk-based approach intended to protect customer information, maintain service integrity and support operational resilience throughout the technology lifecycle.
Security responsibilities are shared. AF-X manages controls within the services it operates, while customers remain responsible for their users, endpoints, credentials, permissions and configuration choices.
02Identity and access management
Access to systems and information is restricted according to business need and appropriate roles. Access-management practices are selected according to the system, data and service involved.
- Role-based access and least-privilege principles
- Approval and controlled provisioning of access
- Authentication and authorisation appropriate to system risk
- Review and removal of access when roles or responsibilities change
03Data protection
AF-X applies technical and organisational safeguards designed to protect information during transmission, storage and authorised use. Measures are selected according to data sensitivity, service architecture and contractual requirements.
Data-processing responsibilities, retention and deletion requirements are documented through the applicable customer agreement and, where relevant, a Data Processing Addendum.
04Secure development lifecycle
Security considerations are incorporated into design, development, testing, deployment and change-management processes.
- Peer review and controlled software changes
- Dependency and vulnerability review
- Testing appropriate to the nature of the change
- Controlled deployment and release processes
- Separation of development and production responsibilities where appropriate
05Monitoring and logging
Relevant infrastructure, systems and operational activities are monitored to help identify availability issues and unusual, unauthorised or potentially malicious behaviour.
Access to operational and security information is restricted. Alerts and events are assessed according to service context and potential impact.
06Vulnerability management
Potential vulnerabilities are identified through appropriate testing, technology-provider information and responsible reports. Findings are evaluated and prioritised according to risk, exposure and service impact.
Remediation is managed through defined operational processes. Specific timelines are governed by internal risk treatment and applicable customer commitments.
07Incident response
AF-X maintains processes designed to identify, contain, investigate, remediate and recover from security incidents.
Where an incident affects customer information or services, communication and notification are managed according to applicable law, contractual commitments and the circumstances of the incident. Lessons identified during review are used to improve controls and operating practices.
08Resilience and continuity
Backup, restoration, recovery and continuity measures are applied according to service requirements to support operational resilience.
Customer-specific recovery objectives, service commitments and continuity arrangements are defined in the applicable service documentation or agreement rather than on this public page.
09Suppliers and sub-processors
Infrastructure, support and technology providers are assessed according to the services they provide and the information or systems they may access. Appropriate contractual, confidentiality and data-protection requirements are applied.
Information about processing locations and relevant sub-processors is available on the Data Residency page and through applicable customer documentation.
10Customer responsibility
Customers contribute to the security of their AF-X environment by managing authorised users, assigning appropriate roles, protecting credentials and endpoints, reviewing access, and applying agreed configuration and integration controls.
Detailed responsibility boundaries are defined during solution design and in the applicable customer documentation.
11Customer assurance
Enterprise customers may request additional information where appropriate and subject to confidentiality requirements.
- Security questionnaires
- Architecture and integration information
- Technical and organisational measures
- Data-protection and sub-processor information
- Customer-specific security reviews
12Standards and certifications
AF-X applies recognised technical and organisational security practices appropriate to its services. Certifications and independently verified standards will only be published after formal confirmation.
This page does not claim a certification, audit result or compliance status that has not been formally verified.
13Report a security concern
If you believe you have identified a security issue, please provide the affected page or service, a clear description, steps to reproduce where appropriate and your contact details. Do not access, alter or disclose information that does not belong to you.
We will review responsible reports and route them to the appropriate technical or operational team.
Security enquiries and responsible reports may be sent to info@af-x.ai.
Bring your security questions to a working session.
Book a demo and bring your security and procurement questions. We will cover them in the session.
