About · Privacy
Privacy and information security
Keystone Assurance is committed to protecting the privacy, confidentiality, integrity, and availability of personal, client, employee, supplier, and business information entrusted to us. We handle information responsibly, use it only for legitimate and authorized purposes, and apply safeguards appropriate to the nature and sensitivity of the data.
01
Privacy
Our approach
Our approach combines governance, risk management, secure technology, defined processes, and workforce awareness. We seek to comply with applicable privacy, data protection (DPDPA), contractual, and information security requirements throughout the information lifecycle, from collection and use to storage, sharing, retention, and secure disposal.
02
Privacy
Our Privacy and Security Commitments
- Lawful and transparent use: Collect and process personal information fairly, for defined purposes, and with appropriate notice or authorization.
- Data minimization: Obtain and retain only the information reasonably needed for business, legal, contractual, or assurance activities.
- Access control: Limit information access to authorized people based on business need and assigned responsibilities.
- Security by design: Consider privacy and information security risks when introducing or changing processes, systems, services, suppliers, and technologies.
- Secure handling: Protect information during storage, transmission, use, sharing, backup, retention, and disposal through proportionate administrative, technical, and physical safeguards.
- Third-party assurance: Apply appropriate due diligence, confidentiality obligations, and security expectations to suppliers and service providers that handle information for us.
- Awareness and responsibility: Require everyone working for or on behalf of Keystone Assurance to protect credentials, devices, records, and confidential information and to complete relevant training.
- Resilience and improvement: Monitor risks and controls, maintain response and recovery arrangements, and improve safeguards using reviews, testing, lessons learned, and changes in requirements.
03
Privacy
Reporting Privacy or Security Concerns
Suspected loss, unauthorized access, disclosure, misuse, alteration, or destruction of information should be reported promptly through the designated internal escalation channel. Keystone Assurance assesses reported events, takes appropriate containment and corrective action, and makes required notifications in accordance with applicable obligations.
04
Privacy
Accountability
Leadership provides oversight and resources for privacy and information security. Everyone working for or on behalf of Keystone Assurance is responsible for following applicable requirements, protecting information under their control, and reporting concerns without delay. Our practices are reviewed periodically to remain proportionate to evolving risks, technologies, stakeholder expectations, and regulatory requirements.