<h2><strong>Secure Software Development Lifecycle (SDLC)</strong></h2><p>We follow a secure software development lifecycle that incorporates security activities throughout planning, development, testing, deployment, and maintenance. Security reviews and testing are embedded into our delivery processes to identify and address risks before production release.</p><h3><strong>Secure Development Lifecycle Policy</strong></h3><p>Our development teams operate under documented secure development standards that define security requirements for system design, coding practices, testing activities, and deployment procedures. These standards are regularly reviewed and communicated across engineering teams.</p><h3><strong>Separation of Development and Production Environments</strong></h3><p>Development, testing, and production environments are maintained separately with appropriate access controls and change management processes. This segregation helps protect production services and minimizes the risk of unauthorized changes or data exposure.</p><h3><strong>Static Code and Dependency Scanning</strong></h3><p>Source code and third-party components are automatically scanned as part of the CI/CD pipeline to identify security vulnerabilities, coding weaknesses, and outdated dependencies prior to deployment.</p><h3><strong>Peer Code Reviews</strong></h3><p>All code changes are subject to peer review through a pull request process before being merged into shared branches. Reviews include consideration of security, quality, maintainability, and compliance with development standards.</p><h3><strong>Automated Dependency and Secret Scanning</strong></h3><p>Automated security tooling continuously scans repositories and build pipelines for vulnerable dependencies, exposed secrets, and configuration issues. Findings are reviewed and remediated in accordance with our vulnerability management processes.</p><h3><strong>Third-Party Penetration Testing</strong></h3><p>Independent security specialists conduct penetration testing of externally accessible applications and services to validate the effectiveness of security controls and identify potential weaknesses.</p>

Application Security

<h3><strong>Encryption at Rest</strong></h3><p>Data stored within our environment is protected using industry-standard encryption mechanisms to help safeguard sensitive information from unauthorized access.</p><h3><strong>Encryption in Transit</strong></h3><p>Data transmitted between users, systems, and services is protected using secure transport protocols and encryption standards to maintain confidentiality and integrity during transmission.</p><h3><strong>Data Classification and Handling</strong></h3><p>We maintain documented data classification and handling requirements that define how information should be accessed, processed, stored, shared, and protected based on its sensitivity and business value.</p><h3><strong>Data Classification Programme</strong></h3><p>A formal data classification framework supports the consistent identification and protection of information assets across the organisation, ensuring appropriate security controls are applied throughout the information lifecycle.</p><h3><strong>Secure Data Retention and Disposal</strong></h3><p>Data retention periods and disposal requirements are defined through documented policies and procedures. Information is retained only as long as necessary to meet business, legal, contractual, and regulatory obligations and is securely disposed of when no longer required.</p><h3><strong>Data Protection by Design and Default</strong></h3><p>Privacy and information security considerations are embedded into our systems, processes, and service delivery practices from the outset. Our approach is aligned with ISO 27001 principles and applicable Australian privacy and data protection requirements, helping ensure appropriate safeguards are implemented throughout the information lifecycle.</p><h3><strong>Secure Data Deletion</strong></h3><p>Data is securely removed in accordance with documented retention and disposal procedures when it is no longer required, helping minimise residual data exposure and support compliance obligations.</p>

Data Security

<h3><strong>Multi-Factor Authentication</strong></h3><p>Multi-factor authentication is implemented for appropriate systems and access scenarios to strengthen account security and reduce the risk of unauthorized access resulting from compromised credentials.</p><h3><strong>Role-Based Access Control</strong></h3><p>Access permissions are assigned based on job responsibilities and the principle of least privilege, ensuring personnel receive only the level of access required to perform their duties.</p><h3><strong>Single Sign-On Integration</strong></h3><p>Centralized identity and access management capabilities streamline user authentication, support account lifecycle management, and enable the consistent application of security controls across integrated systems.</p><h3><strong>Just-in-Time Privileged Access</strong></h3><p>Privileged access to cloud infrastructure is granted on a time-bound, approval-based basis when administrative intervention is required. This approach minimizes standing administrative privileges and improves accountability for privileged activities.</p><h3><strong>Access Reviews</strong></h3><p>User and privileged access rights are regularly reviewed to verify ongoing business need, validate appropriate privilege levels, and reduce the risk of excessive or unauthorized access. Access assignments are periodically assessed against approved requests and business requirements to ensure elevated privileges remain justified and appropriate.</p><h3><strong>Confidential and Critical System Access Reviews</strong></h3><p>We conduct periodic reviews of access to confidential and critical systems to confirm that permissions remain appropriate, aligned with business requirements, and consistent with the principle of least privilege. Identified discrepancies are remediated through established access management processes.</p><h3><strong>Account Lockout and Session Management</strong></h3><p>Account protection mechanisms, including lockout controls and session management policies, help reduce the risk of unauthorized access resulting from brute-force attacks, credential misuse, or unattended sessions.</p><p> </p>

Access Controls

<h3><strong>Device Inventory and Management</strong></h3><p>Company-managed devices are inventoried, monitored, and maintained throughout their lifecycle. Asset management processes help ensure devices are appropriately configured, supported, and tracked in accordance with security requirements.</p><h3><strong>Disk Encryption</strong></h3><p>Encryption is implemented on company-managed devices to help protect sensitive information from unauthorized access in the event of device loss, theft, or physical compromise.</p><h3><strong>Endpoint Protection</strong></h3><p>Endpoints are protected through centrally managed security controls that provide threat prevention, detection, investigation, and response capabilities. Security monitoring is performed across endpoint and cloud environments to support the identification and remediation of malicious activity.</p><h3><strong>Next-Generation Antivirus and EDR</strong></h3><p>We utilize Microsoft Defender technologies, including Microsoft Defender XDR and Microsoft Defender for Cloud, to provide next-generation antivirus, endpoint detection and response (EDR), threat intelligence, and cloud security monitoring capabilities. These controls support the detection, investigation, and containment of security threats across our environment.</p><h3><strong>Operating System and Security Updates</strong></h3><p>Operating systems and software are regularly updated to address security vulnerabilities and maintain compliance with internal security standards. Critical security updates are prioritized to reduce exposure to known threats.</p><h3><strong>Automatic Screen Lock and Workspace Security</strong></h3><p>Company-managed devices are configured with automatic screen-lock controls to reduce the risk of unauthorized access. Employees are also expected to follow workspace security practices when handling sensitive or confidential information.</p><h3><strong>Removable Media Controls</strong></h3><p>The use of removable media is restricted and managed based on business requirements. Access is granted only to authorized personnel where justified, and usage is subject to security controls and oversight to mitigate the risks of malware introduction, unauthorized data transfer, and data loss.</p>

Endpoint Security

<h3><strong>Network Segmentation</strong></h3><p>Our network architecture incorporates logical segmentation and security boundaries to limit unauthorized access, reduce the potential impact of security incidents, and support the protection of critical systems and data.</p><h3><strong>Secure Network Design</strong></h3><p>Network infrastructure is designed and maintained in accordance with documented security standards. Connectivity between systems is restricted to approved business requirements and is regularly reviewed to support secure operations.</p><h3><strong>Internet and Perimeter Security</strong></h3><p>Network traffic is protected through security controls designed to detect, filter, and block unauthorized or malicious activity. External connectivity is managed through controlled ingress and egress points to reduce exposure to threats.</p><h3><strong>Firewall Management</strong></h3><p>Firewalls are implemented to enforce network security policies and restrict communications to authorized services and business requirements. Firewall configurations are subject to periodic review and change management processes.</p><h3><strong>Cloud Network Security</strong></h3><p>Cloud-hosted environments are configured using security best practices, including network segregation, secure administrative access, encryption of sensitive data, and controlled connectivity between systems and environments.</p><h3><strong>Environment Segregation</strong></h3><p>Development, testing, and production environments are logically separated to reduce the risk of unauthorized access, accidental changes, or unintended disclosure of information.</p><h3><strong>Secure Administrative Access</strong></h3><p>Administrative access to network devices, cloud resources, and critical infrastructure is restricted to authorized personnel and protected through appropriate authentication and access management controls.</p><h3><strong>Wireless Network Security</strong></h3><p>Corporate wireless networks employ industry-standard encryption and authentication mechanisms. Guest wireless access, where provided, is segregated from internal corporate systems and resources.</p><h3><strong>Remote Access Security</strong></h3><p>Remote access to corporate resources is controlled through secure access mechanisms, strong authentication requirements, and access controls aligned with business needs and security requirements.</p><h3><strong>Network Infrastructure Hardening</strong></h3><p>Network devices and supporting infrastructure are configured according to secure baseline standards. Unnecessary services, ports, and default configurations are removed or disabled wherever practical.</p><h3><strong>Logging and Monitoring</strong></h3><p>Network, infrastructure, and security-relevant events are logged and monitored to support threat detection, incident investigation, operational monitoring, and compliance requirements.</p><h3><strong>Network Vulnerability Management</strong></h3><p>Network-connected systems and infrastructure are subject to vulnerability management processes, including security assessments, vulnerability scanning, patch management, and remediation activities.</p><p> </p>

Network Security

<h3><strong>Risk Management</strong></h3><p>We maintain a formal risk management program that identifies, assesses, and tracks information security risks across the organisation. Risks are documented in risk registers, reviewed regularly by relevant stakeholders, and managed through defined treatment plans designed to reduce residual risk to acceptable levels.</p><h3><strong>Risk Assessments and Reviews</strong></h3><p>Information security risks are assessed periodically and whenever significant changes to the business, technology landscape, or threat environment occur. Risk reviews ensure that emerging threats, vulnerabilities, and business impacts are appropriately evaluated and addressed.</p><h3><strong>Security Policies and Governance</strong></h3><p>We maintain a suite of documented information security policies and standards aligned with ISO 27001:2022 and Cyber Essentials principles. Policies are reviewed regularly and updated as required to reflect changes in regulatory requirements, business operations, technology, and emerging threats.</p><h3><strong>Policy Review and Awareness</strong></h3><p>Security policies and standards are subject to formal review and approval processes. Updated policies are communicated to employees and relevant third parties to promote ongoing awareness, compliance, and understanding of security responsibilities.</p><h3><strong>Incident Response Management</strong></h3><p>We maintain documented incident response procedures that define the processes for identifying, reporting, assessing, containing, investigating, and recovering from security incidents. Roles, responsibilities, escalation paths, and communication requirements are clearly established to support effective incident handling.</p><h3><strong>Incident Response Testing</strong></h3><p>Incident response capabilities are validated through regular tabletop exercises and simulated incident scenarios. These activities help assess preparedness, improve response effectiveness, and identify opportunities for continuous improvement.</p><h3><strong>Disaster Recovery and Business Resilience</strong></h3><p>Documented disaster recovery and business continuity procedures are maintained to support the restoration of critical systems and services following disruptive events. Recovery plans are periodically tested through exercises designed to validate recovery capabilities and operational readiness.</p><h3><strong>Internal Security Audits and Compliance Monitoring</strong></h3><p>Internal reviews and assurance activities are conducted to evaluate the effectiveness of security controls, verify compliance with internal requirements, and support continual improvement of the information security management system.</p><h3><strong>Post-Incident Review and Continuous Improvement</strong></h3><p>Significant security incidents are subject to post-incident review processes to identify root causes, assess the effectiveness of response activities, and implement corrective actions aimed at strengthening the security posture.</p><h3><strong>Roles, Responsibilities, and Accountability</strong></h3><p>Information security roles and responsibilities are formally defined and assigned across the organisation. Governance processes ensure appropriate oversight, accountability, and ownership of information security risks, controls, and compliance obligations.</p>

Corporate Security and Governance

<h3><strong>ISO/IEC 27001:2022 Certification</strong></h3><p>We maintain an ISO/IEC 27001:2022 certified Information Security Management System (ISMS) that supports the systematic management of information security risks, implementation of security controls, and continual improvement of our security practices.</p><h3><strong>Cyber Essentials Certification</strong></h3><p>We maintain Cyber Essentials certification, demonstrating the implementation of foundational cyber security controls designed to protect against common cyber threats and support secure business operations.</p><h3><strong>Internal Control Reviews</strong></h3><p>Security controls are reviewed periodically as part of our governance, risk management, compliance, and audit activities to verify their effectiveness and ongoing alignment with business and security requirements.</p><h3><strong>Surveillance Audits and Continuous Improvement</strong></h3><p>Our ISO/IEC 27001 certification is subject to regular surveillance audits conducted by an accredited certification body. Findings, observations, and improvement opportunities are incorporated into our continual improvement processes.</p><h3><strong>Vendor Due Diligence and Compliance Management</strong></h3><p>We maintain a vendor due diligence process to assess relevant security, privacy, and compliance considerations when engaging third-party suppliers. Vendor risks are evaluated and managed in accordance with business and regulatory requirements.</p><h3><strong>Privacy and Data Protection</strong></h3><p>We maintain documented privacy and data protection policies that govern the collection, use, storage, and handling of personal information in accordance with applicable legal, contractual, and regulatory obligations.</p>

Compliance and Auditing

<p><strong>Role-Based Access Control (RBAC)</strong></p><p>Our platform provides role-based access control so that customers can assign permissions according to job responsibilities using the principle of least privilege. Administrators can define and manage user roles to ensure users only have access to the data they need to perform their duties.</p><p></p><p><strong>Multi-Factor Authentication (MFA)</strong></p><p>Customers can enable multi-factor authentication for their users to strengthen account security. MFA adds an additional verification step beyond a password, reducing the risk of unauthorized access resulting from compromised credentials.</p><p></p><p><strong>Single Sign-On (SSO) Integration</strong></p><p>Our platform supports integration with Microsoft Entra ID for single sign-on. This allows customers to centrally manage user authentication and account lifecycle, and to consistently apply their own identity and access policies across integrated systems.</p><p></p><p><strong>Encryption of Customer Data</strong></p><p>Customer data is protected using industry-standard encryption, both at rest within our environment and in transit between users, systems, and services. This helps maintain the confidentiality and integrity of customer information.</p><p></p><p><strong>Environment Segregation</strong></p><p>Development, testing, and production environments are separated with appropriate access controls and change management. This protects customer production services and data from unauthorized or accidental changes.</p><p>    </p><p><strong>Audit Logging</strong></p><p>The 12d Synergy platform logs user and administrative actions, which may be retrieved via the administrative portal. Additionally, we maintain additional logs at an infrastructure level that we audit on a regular basis for unusual activity.</p><p>  </p>

Product Security

<h3><strong>Pre-employment Background Checks</strong></h3><p>All employees undergo pre-employment screening appropriate to their role before being granted system access. Screening may include identity verification, employment history validation, and other checks permitted by applicable laws and regulations.</p><h3><strong>Security Awareness Training and Phishing Simulations</strong></h3><p>Employees complete mandatory security awareness training during onboarding and at regular intervals thereafter. To reinforce secure behaviours and measure effectiveness, we conduct quarterly phishing simulation campaigns that help identify training opportunities and strengthen resilience against social engineering attacks.</p><h3><strong>Secure Coding Training</strong></h3><p>Developers receive ongoing secure coding education aligned with industry best practices and secure development standards. Training focuses on identifying and mitigating common software vulnerabilities throughout the development lifecycle.</p><h3><strong>Acceptable Use and Confidentiality Agreements</strong></h3><p>All employees acknowledge and comply with acceptable use, confidentiality, and information security policies as a condition of employment and access to company systems and information.</p><h3><strong>Employee Offboarding Controls</strong></h3><p>Formal offboarding procedures ensure that system access, accounts, credentials, and company assets are revoked or recovered promptly upon employee departure or role change, reducing the risk of unauthorized access.</p><h3><strong>Disciplinary Policy</strong></h3><p>Documented disciplinary procedures support the enforcement of security policies and establish accountability for breaches of company standards, policies, or acceptable use requirements.</p>

Employment Security and Awareness

<h3><strong>Vendor Due-Diligence Assessments</strong></h3><p>We perform risk-based vendor due diligence assessments prior to engaging third parties. Assessment requirements are determined based on vendor criticality, data sensitivity, service scope, and overall supply chain risk.</p><h3><strong>Due Diligence and Onboarding Assessments</strong></h3><p>New vendors undergo a security and compliance assessment as part of the onboarding process. Vendors classified as Confidential or Critical are subject to additional review activities to ensure identified risks are appropriately understood and managed before engagement.</p><h3><strong>Annual Vendor Re-evaluation</strong></h3><p>Critical vendors are reassessed at least annually as part of our ongoing third-party risk management program. Reassessments consider changes to the vendor's security posture, services, compliance status, and overall risk profile.</p><h3><strong>Annual Review and Reassessment of Vendors</strong></h3><p>Vendor risk assessments are periodically reviewed and updated to reflect changes in business requirements, threat landscape, regulatory obligations, and supplier services.</p><h3><strong>Contractual Data Protection Agreements</strong></h3><p>Appropriate contractual provisions are incorporated into vendor agreements to establish requirements relating to information security, confidentiality, privacy, and data protection responsibilities.</p><h3><strong>Non-Disclosure Agreements</strong></h3><p>Confidentiality obligations are established through contractual agreements where appropriate to ensure the protection of company, customer, and other sensitive information shared with third parties.</p><h3><strong>Centralised Vendor Inventory</strong></h3><p>We maintain a centralised inventory of third-party suppliers that records vendor ownership, risk classification, assessment status, service details, and review requirements to support ongoing governance and oversight.</p><h3><strong>Published Subprocessor List and Notification Process</strong></h3><p>Where applicable, subcontractors and third-party service providers involved in service delivery are managed through established governance processes designed to maintain visibility and oversight of supply chain risks.</p><h3><strong>Contractual Security Obligations</strong></h3><p>Security requirements are incorporated into vendor engagements based on the nature of the services provided and the associated risk assessment outcomes. Where necessary, security controls, contractual commitments, or service limitations may be negotiated with vendors to mitigate identified risks and ensure the protection of company and customer data.</p><h3><strong>Supply Chain Risk Management</strong></h3><p>Supply chain risks are assessed using a risk-based approach aligned with NIST SP 800-161 principles. Identified risks are documented, evaluated, and managed through defined treatment plans and ongoing vendor oversight activities.</p>

Third-party and supply chain management

<p>You can find our privacy statement here:</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.12dsynergy.com/privacy-notice/">www.12dsynergy.com/privacy-notice/</a></p><p></p><p>We adhere to GDPR in the UK and the EU and our DPA is available here:</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.12dsynergy.com/dpa">www.12dsynergy.com/dpa</a></p><p></p>

12d Synergy Pty Ltd Trust Center

Documents

Security Controls

Secure Software Development Lifecycle (SDLC)

Secure Development Lifecycle Policy

Separation of Development and Production Environments

Static Code and Dependency Scanning

Peer Code Reviews

Automated Dependency and Secret Scanning

Third-Party Penetration Testing