Security

============================================================

AcknowledgePoint is designed to help companies create policies, assign documents, collect acknowledgements, and maintain records in a clean, organized, and business-ready platform. We understand that customers rely on AcknowledgePoint to manage important company documents and employee acknowledgement records. Security is a core part of how we design, operate, and improve the Services.

This Security Statement describes our general security approach. It is not intended to disclose confidential technical details or create warranties beyond those stated in our Terms of Service or written agreements.

1. Security Philosophy

AcknowledgePoint follows a practical, risk-based security approach focused on protecting customer accounts, administrator access, employee acknowledgement records, document data, platform availability, and operational integrity.

Our security program is designed around the following principles:

• protect customer data;
• limit access to authorized users;
• reduce unnecessary data collection;
• maintain secure authentication and authorization controls;
• monitor for suspicious activity;
• use trusted infrastructure and service providers;
• support reliable backups and recovery;
• maintain auditability where appropriate;
• respond to security events; and
• continually improve security as the platform grows.

2. Data Protection

AcknowledgePoint may process information such as company names, administrator names, employee names, email addresses, departments, locations, document assignments, acknowledgement statuses, timestamps, billing metadata, and audit-related records.

We use reasonable safeguards designed to protect this information against unauthorized access, loss, misuse, alteration, or disclosure.

3. Encryption

AcknowledgePoint is intended to use encryption in transit to protect data transmitted between user browsers and the platform.

Where supported by our hosting and database providers, data may also be protected using encryption at rest or provider-managed storage security controls.

4. Access Controls

AcknowledgePoint uses role-based access concepts to separate users by function and permission level.

Access controls may include:

• company-level account separation;
• administrator roles;
• user roles;
• permission-based feature access;
• authentication controls;
• restricted administrative functions;
• session management; and
• account status controls.

Customers are responsible for assigning appropriate access rights, limiting administrator privileges, and removing users who no longer require access.

5. Authentication and Account Security

AcknowledgePoint uses account authentication to help ensure that only authorized users can access the Services.

Customers and users are responsible for:

• using strong passwords;
• protecting login credentials;
• not sharing administrator accounts;
• promptly reporting suspected unauthorized access;
• maintaining accurate user lists;
• removing inactive users; and
• securing devices used to access the Services.

If multi-factor authentication, single sign-on, or additional authentication features are offered, customers are encouraged to enable them where appropriate.

6. Logging and Monitoring

AcknowledgePoint may collect logs and activity records to support security, troubleshooting, auditing, account administration, and service improvement.

Logs may include:

• login events;
• failed login attempts;
• administrative actions;
• document activity;
• assignment activity;
• acknowledgement activity;
• billing status events;
• system errors;
• performance data; and
• security-related events.

7. Audit and Acknowledgement Records

AcknowledgePoint is designed to help customers maintain acknowledgement records, including assigned documents, user status, due dates, completion dates, overdue status, and other relevant activity.

Customers are responsible for reviewing, exporting, and retaining acknowledgement records according to their own legal, HR, safety, compliance, and operational requirements.

8. Infrastructure and Hosting

AcknowledgePoint may use reputable cloud hosting, database, email, monitoring, billing, and infrastructure providers. These providers may maintain their own security, availability, and compliance controls.

AcknowledgePoint evaluates service providers based on operational need, reliability, security posture, and business requirements.

9. Backups and Recovery

AcknowledgePoint may maintain backups or recovery processes designed to support business continuity, data protection, and service restoration.

Backup frequency, retention, and restoration capabilities may vary depending on the environment, service tier, infrastructure provider, and operational requirements.

10. Vulnerability Management

AcknowledgePoint intends to maintain a practical vulnerability management process that may include:

• reviewing platform dependencies;
• applying security updates;
• monitoring for known vulnerabilities;
• testing key workflows;
• reviewing access controls;
• addressing identified risks; and
• improving security as the platform evolves.

11. Incident Response

AcknowledgePoint maintains procedures to evaluate and respond to suspected security incidents.

If AcknowledgePoint becomes aware of a confirmed security incident affecting customer data, we will take reasonable steps to investigate, contain, remediate, and notify affected customers as required by applicable law and contractual obligations.

Security incident notices may include information such as:

• nature of the incident;
• affected data categories, if known;
• recommended customer actions;
• remediation steps taken or planned; and
• contact information for follow-up.

12. Customer Security Responsibilities

Security is a shared responsibility. Customers are responsible for:

• controlling who has access to their account;
• assigning appropriate administrator roles;
• keeping user records accurate;
• reviewing employee access;
• using strong passwords;
• protecting devices;
• securing exported reports;
• reviewing policy content before publication;
• limiting sensitive information in documents;
• monitoring account activity;
• promptly reporting suspicious activity; and
• complying with applicable laws and internal security policies.

13. Payment Security

AcknowledgePoint does not intend to collect or store full payment card numbers directly inside the AcknowledgePoint application.

If customers pay invoices through a third-party billing or payment provider, such as QuickBooks or another payment platform, payment information is handled by that provider according to its own terms, privacy policy, and security practices.

14. Limitations

No online service can guarantee absolute security. While AcknowledgePoint uses reasonable safeguards, we cannot guarantee that unauthorized access, data loss, misuse, or security incidents will never occur.

15. Reporting Security Concerns

If you believe you have discovered a security issue involving AcknowledgePoint, please report it promptly.

Security Contact: Email: [[email protected]] Support: [[email protected]] Website: https://acknowledgepoint.com

Please include:

• a description of the issue;
• steps to reproduce, if applicable;
• affected URL or feature;
• screenshots or logs, if available;
• your contact information; and
• whether you believe customer data may be affected.

Do not access, modify, delete, download, or disclose data that does not belong to you. Do not perform testing that could disrupt the Services.

============================================================