# Information security policy

**Draft for review.** Not approved. Owner: `{{SECURITY_OWNER}}`. Last reviewed: `{{REVIEW_DATE}}`.
Applies to `{{COMPANY_LEGAL_NAME}}`, everyone who works on or operates Veteros, and every system that
stores or processes clinic data.

## Purpose

Protect the confidentiality, integrity and availability of the data clinics trust Veteros with:
client and pet records, visit audio, transcripts and notes, and staff accounts.

## Principles

1. **Clinic data belongs to the clinic.** Veteros processes it only to provide the service, never
   to train models, and only through the sub-processors listed in `docs/v2/subprocessors.md`.
2. **Isolation is enforced by the system.** The tenant comes from the session, never from the
   client. Row-level security is forced on every tenant table and composite foreign keys keep rows
   inside their organization.
3. **Least privilege.** People and services get the narrowest access their work needs (see the
   access control policy). The request role cannot read secrets.
4. **Encryption.** Audio, documents and secrets are encrypted at rest with AES-256-GCM; all traffic
   uses HTTPS.
5. **History is append-only.** Audit, consent and note history is never edited or deleted outside
   a sanctioned, audited redaction path.
6. **Synthetic data only outside production.** Live clinic data never enters development or tests.
7. **AI output is a draft.** No clinical action, signed note or client message happens because a
   model said so.

## Roles

| Role | Responsibility |
|---|---|
| Security owner (`{{SECURITY_OWNER}}`) | Owns this policy and the readiness programme; approves exceptions; reviews the risk assessment yearly |
| Engineering | Builds and tests controls; keeps `docs/compliance/soc2-control-matrix.md` current |
| Privacy contact (`{{PRIVACY_CONTACT}}`) | Data protection questions and data subject request support for clinics |
| Every team member | Follows these policies and reports incidents at once |

## Related policies

Access control, change management, incident response, vendor management, data retention and
deletion, business continuity, acceptable use (all in this folder).

## Exceptions and review

Exceptions are written, time-limited and approved by the security owner. This policy is reviewed
at least once a year and after any significant incident or change to the service.