Information Security Policy

about us

Information Security Policy

APPrendere believes that protecting the information and data of our customers and partners is
essential to ensure the Confidentiality, Integrity, and Availability of our informational assets. This
approach represents a strategic value that becomes a competitive advantage in the services we
offer.
For this reason, we pay great attention to the selection of suppliers and collaborators with whom
we share information, as well as to the elements that support it: the organization and processes,
technological and physical infrastructures, and people. Through the identification and
management of risks, APPrendere adopts organizational, technical, and procedural measures to
ensure compliance with the following basic security requirements:

Confidentiality: information is accessible only to authorized individuals/resources and is thus unavailable to everyone else;
Integrity: information is accurate, complete, reliable, and changes are controlled; any attempt to tamper with data by unauthorized individuals or caused by events is
prevented/reported;
Availability: information is available to authorized individuals within the time frames and methods established by company policies

Commitment

To offer maximum satisfaction to our customers and partners, and to protect information,
APPrendere has chosen to operate in accordance with the requirements of the Information Security
Management System compliant with the ISO/IEC 27001 standard.

Principles and Objectives

With the adoption of the Information Security Management System, the Company seeks to achieve substantial and measurable results concerning the following principles and objectives:

Ensure compliance with business objectives related to information security, as well as the monitoring of processes and continuous improvement activities;
Ensure the quality of the solutions provided, including in terms of information security, as a guarantee of return (also financial) and customer loyalty;
Ensure proper management and protection of the company’s information assets, as well as personal data;
Deliver services and products continuously, constantly monitoring and improving information security, and managing changes in compliance with the standards set by relevant authorities;
Ensure the adoption and maintenance of a process for identifying potential threats to the company and the impacts that such threats, if realized, could have on the information assets and services provided, ultimately defining a system capable of improving resilience and recovery capabilities;
Minimize the duration of potential service disruptions and maintain effective and efficient
financial management through the adoption of the most advanced and functional
technological, organizational, and procedural solutions;
Effectively manage information security incidents, including potential data breaches, through timely communications and the adoption of appropriate countermeasures;
Ensure partnerships with qualified technology partners, guaranteeing reliability in terms of service quality and information security and data protection;
Improve existing processes and manage innovation with the aim of not only responding to evolving needs but also anticipating potential changes in the environment to maintain a competitive advantage and seize new opportunities;
Promote investments in innovation and technological solutions in line with the growing customer demand;
Promote staff training and information programs to ensure competent and efficient working groups, trained for the role they perform;
Promote full awareness and culture within the Organization regarding information security topics;
Ensure a risk management approach and implementation of appropriate actions to address risks and opportunities for each business objective and process identified within the System;
Ensure compliance with applicable legal requirements.

Method

Therefore, the organization is committed to pursuing information security by:

Using good practices to protect the organization’s informational resources from internal or external, intentional or accidental security threats;
Aligning information security management with the organization’s strategic risk management context;
Setting information security objectives and establishing guidelines and principles for action;
Establishing criteria for risk evaluation and risk acceptance;
Controlling access to informational resources, including networks, based on business and security needs;
Applying safeguards for information sharing;
Ensuring the protection of customer information managed by the organization;
Ensuring compliance with legal requirements and information security principles in contracts with third parties;
Encouraging awareness of information security issues among all collaborators throughout the duration of the working relationship;
Implementing appropriate security measures for mobile computing and communications;
Using, when necessary, appropriate cryptographic controls for information protection;
Prohibiting the use of unauthorized software and complying with intellectual property rights
laws;
Protecting organizational data and privacy;
Timely managing information security incidents and potential data breaches;
Preparing backup copies of information, software, and system images and regularly testing
them;
Preparing a continuity plan that effectively addresses unforeseen events, ensuring the
recovery of services according to existing contractual agreements;
Through specific training plans, discouraging the misuse of information services and data
by collaborators;
Promoting awareness in terms of information security.

The Management of APPrendere is committed to taking an active role in promoting all activities
that influence Information Security through:

The dissemination and awareness, at all levels and to all interested parties, of this Policy as well as the concepts expressed within it;
The full availability of the means and resources necessary for the implementation and maintenance of this System;
The preparation of a monitoring plan for the proposed objectives.

The preparation of a monitoring plan for the proposed objectives.
Our information security policy is constantly updated and reviewed to ensure continuous improvement. The policy is shared with the entire organization and made available to customers, stakeholders, partners, and third parties.

about us