Information Security Policy

1. Purpose and scope

This policy sets out Dictalogic Ltd's commitment to the confidentiality, integrity and availability of all information assets across its cloud-based, AI-powered SaaS products: dictation and AI transcription, LogicNotes (AI meeting notes), Timentry (AI time tracking) and Case Forte (CRM for law firms). It is the governance framework for Dictalogic's integrated Information Security and Quality Management System (IS&QMS).

The policy applies to:

• All employees, contractors and third parties working under Dictalogic management
• All information assets and cloud systems, hosted on Microsoft Azure
• All business processes, service delivery and remote working
• All personal devices (BYOD) used for business purposes
• All data processing, including client content, across every product line

Physical infrastructure, client-owned devices and networks, and personal use of personal devices are outside scope.

2. Management commitment

Top management of Dictalogic Ltd commits to:

• Establishing, implementing, maintaining and continually improving the IS&QMS
• Setting and communicating information security objectives aligned with business strategy
• Integrating IS&QMS requirements into all business processes
• Allocating the financial, human and technical resources needed for effective security
• Promoting a security-aware culture through training and awareness
• Conducting regular management reviews of ISMS performance
• Complying with applicable legal, regulatory and contractual security obligations

3. Core security principles

Confidentiality, integrity and availability

• Information is protected from unauthorised disclosure, alteration or loss.
• Access is role-based, on the principle of least privilege.
• The SaaS platform has a 99.5% availability target.
• All data is encrypted in transit (TLS 1.2 minimum) and at rest (AES-256 on Azure).

Risk-based approach

• Security risks are assessed before any material system change or new processing activity.
• The risk register is maintained and reviewed at least annually.
• Controls are proportionate to identified risk and business impact.
• Every risk acceptance decision is documented with management authorisation.

Privacy by design

• Privacy and data protection controls are built in from the point of service and system design.
• Data minimisation, purpose limitation and storage limitation apply throughout.
• Data Protection Impact Assessments are carried out for high-risk processing.
• Zero-Access Policy: Dictalogic staff do not access client content, except with the client's prior written permission for a defined technical purpose, and then only by authorised senior management.

Cloud security

• Production infrastructure is hosted on Microsoft Azure.
• Microsoft Entra ID is the authoritative source for staff identity and access control.
• Production configurations are governed by the Change & Configuration Management Policy.
• Timentry is served through Cloudflare, which accepts only TLS 1.2 or later and enforces HTTPS (HSTS). Credentials Timentry holds for connected services, such as Zoom, are encrypted with AES-256-GCM before they are stored.

4. Regulatory compliance

Certificates are available on request: request our ISO certificates.

5. Roles and responsibilities

6. Supporting policies

This policy is the top-level framework. Detailed requirements sit in standalone policies, all subordinate to it:

• Access Control & Rights Management
• Backup & System Redundancy
• Change & Configuration Management
• Confidentiality & NDA
• Cryptography
• Data Masking & Redaction
• Employment Lifecycle Security
• Incident Reporting & Management
• Independent Review of Information Security
• Information Classification & Labelling
• Information Deletion
• Information Security for Cloud Services
• Logging & Monitoring
• Privacy Protection
• Protection Against Malware
• Risk Assessment & Treatment
• Secure Development Framework
• Security & ICT Resilience
• Technical Vulnerability Management
• Third-Party Security Management
• User Endpoint & Remote Working

7. Security objectives

• Maintain UKAS-accredited ISO/IEC 27001:2022 certification
• Achieve ISO 9001:2015 certification
• Ensure HIPAA compliance as a Business Associate for all healthcare clients
• Maintain full UK GDPR and EU GDPR compliance and meet DUAA 2025 obligations as they come into force
• Maintain 99.5% SaaS platform availability
• Zero critical security incidents causing unauthorised disclosure of client PHI or PII
• 100% annual security awareness training completion
• Respond to every data subject request within the 30-day GDPR deadline

8. Review and improvement

This policy is reviewed annually by the Director Compliance and approved by the CEO, or sooner after a material regulatory change, security incident or significant operational change. Performance is monitored through internal audit and management review, and nonconformities are managed through a corrective action process.