Security Policy

Build Coff is committed to protecting the security, integrity, and confidentiality of all data processed through our platform and services. This Security Policy describes the technical and organisational measures we implement to safeguard our systems and the information entrusted to us by our users.

This policy applies to all systems, infrastructure, applications, and services operated by Build Coff, including our web platform at buildcoff.com, associated APIs, and any data storage or processing environments used in the delivery of our educational services.

We apply the following core principles to all data security practices:

• Confidentiality: Access to data is restricted to authorised personnel and systems on a strict need-to-know basis.
• Integrity: We implement controls to prevent unauthorised modification or corruption of data.
• Availability: We maintain systems and processes to ensure reliable access to services for authorised users.
• Accountability: Security responsibilities are assigned, documented, and reviewed on a regular basis.

• All production systems are hosted on infrastructure that maintains industry-standard physical and environmental security controls.
• Network traffic is segmented and monitored to detect and prevent unauthorised access.
• Firewalls, intrusion detection systems, and rate-limiting controls are applied at the network perimeter.
• Unused ports, protocols, and services are disabled by default.

• All data transmitted between users and our platform is encrypted in transit using TLS 1.2 or higher.
• HTTP connections are automatically redirected to HTTPS.
• Security headers including HSTS, Content Security Policy, and X-Frame-Options are applied across all web-facing services.

• Sensitive data at rest is encrypted using industry-accepted encryption standards.
• Database access is restricted to application-layer services using least-privilege credentials.
• Backups are encrypted and stored separately from primary production systems.

• Access to production systems and sensitive data is limited to authorised Build Coff personnel whose roles require it.
• All internal accounts use strong authentication requirements, including multi-factor authentication where applicable.
• Access rights are reviewed periodically and revoked promptly upon role change or departure.
• All privileged access sessions are logged and subject to audit.

• User passwords are stored using one-way cryptographic hashing with salting.
• Users are encouraged to use strong, unique passwords for their accounts.
• Account lockout mechanisms are in place to mitigate brute-force attempts.
• Session tokens are invalidated upon logout and expire after a defined period of inactivity.

• Our development process incorporates security considerations at each stage, including design, development, testing, and deployment.
• Code changes undergo review before deployment to production environments.
• We apply protections against common web application vulnerabilities including but not limited to SQL injection, cross-site scripting, cross-site request forgery, and insecure direct object references.
• Third-party dependencies are monitored for known vulnerabilities and updated on a regular basis.
• Staging and development environments are isolated from production systems and data.

• We conduct periodic vulnerability assessments of our systems and applications.
• Identified vulnerabilities are triaged, prioritised by severity, and remediated within defined timeframes.
• Security patches for operating systems, software, and dependencies are applied in a timely manner.
• We maintain a responsible disclosure process for receiving reports of potential security issues from external parties.

We maintain a documented incident response process that includes the following stages:

1. Detection and identification: Monitoring systems and alerts are in place to detect anomalous activity.
2. Containment: Affected systems or accounts are isolated to limit the impact of a confirmed incident.
3. Investigation: The scope, cause, and impact of the incident are assessed and documented.
4. Remediation: Root causes are addressed and affected systems are restored to a secure state.
5. Notification: Affected users and relevant parties are notified in accordance with applicable obligations and our Privacy Policy.
6. Post-incident review: Lessons learned are documented and used to improve security controls.

• We evaluate the security practices of third-party service providers before engaging their services.
• Data processing agreements are established with vendors who handle personal or sensitive data on our behalf.
• Vendor access to our systems is restricted, monitored, and granted only as necessary.
• We review third-party integrations periodically to ensure continued alignment with our security standards.

• All personnel with access to systems or data are subject to confidentiality obligations.
• Security awareness training is provided to staff on a regular basis.
• Security policies and procedures are communicated to all relevant personnel and reviewed periodically.
• Access credentials are never shared between individuals.

• We maintain backup and recovery procedures to support restoration of services following unexpected disruptions.
• Backups are tested periodically to verify integrity and recoverability.
• Recovery time and recovery point objectives are defined and reviewed as part of our continuity planning.

• System and application logs are collected and retained for a defined period to support security monitoring and incident investigation.
• Logs include access events, authentication activity, and system changes.
• Log data is protected against unauthorised access or tampering.
• Automated alerts are configured for defined security-relevant events.

If you believe you have identified a security vulnerability in any Build Coff service, we encourage responsible disclosure. Please report your findings to us promptly so that we can investigate and address the issue.

Contact us at: support@buildcoff.com

We ask that you:

• Do not access, modify, or delete data that does not belong to you.
• Do not perform actions that could disrupt or degrade our services.
• Provide sufficient detail to allow us to reproduce and investigate the reported issue.
• Allow us reasonable time to investigate and remediate before any public disclosure.

We will acknowledge valid reports and work to resolve confirmed issues in a timely manner.

This Security Policy is reviewed at least annually and updated as necessary to reflect changes in our systems, practices, or applicable requirements. The date at the top of this document indicates when the policy was last revised. Continued use of our services following any update constitutes acceptance of the revised policy.

For questions or concerns regarding this Security Policy or our security practices, please contact us:

• Email: support@buildcoff.com
• Phone: +27 62 307 5492
• Address: 41 Sir Lowry Rd, Woodstock, Cape Town, 8000, South Africa