Infrastructure & Dependency Management Policy

Where appropriate, Calenix separates development, testing; staging; and production environments.

Production credentials and data should not be unnecessarily exposed to development or testing environments.

Access to production infrastructure is limited to authorised personnel.

Access is granted based on:

1. role;
2. business need;
3. least privilege; and
4. operational responsibility.

Privileged access is subject to additional controls where appropriate.

Calenix seeks to maintain controlled and documented configurations for material infrastructure.

Changes should be:

1. authorised;
2. tested where appropriate;
3. recorded;
4. reviewed; and
5. reversible where practical.

Calenix uses third-party libraries and software components where appropriate.

Dependencies should be:

1. sourced from trusted repositories;
2. tracked;
3. periodically reviewed;
4. scanned for known vulnerabilities;
5. updated when appropriate; and
6. removed when no longer necessary.

Known vulnerable dependencies are assessed under the Vulnerability Management Policy.

Calenix may:

1. upgrade the dependency;
2. replace the dependency;
3. apply a security patch;
4. implement compensating controls;
5. restrict affected functionality; or
6. accept the risk temporarily where justified and documented.

Calenix may use open-source software.

Where applicable, Calenix monitors security vulnerabilities, licensing obligations, dependency health, maintenance status, and security advisories.

Secrets such as:

1. API keys;
2. OAuth client secrets;
3. database credentials;
4. encryption keys;
5. signing keys; and
6. service credentials

should be stored using appropriate secret-management mechanisms and must not be intentionally committed to public source repositories.

Third-party services supporting Calenix may include:

1. cloud hosting;
2. databases;
3. authentication providers;
4. payment processors;
5. email providers;
6. analytics services;
7. monitoring services; and
8. integration platforms.

Material providers may be evaluated based on security, reliability, privacy, contractual requirements and business risk.

Material infrastructure changes should undergo appropriate review and testing before deployment.

Emergency changes may be implemented when necessary to:

1. address security incidents;
2. remediate critical vulnerabilities;
3. restore availability; or
4. protect customer data.

Emergency changes should be documented retrospectively.

Calenix monitors relevant infrastructure for:

1. availability;
2. errors;
3. performance;
4. suspicious activity;
5. security events; and
6. operational anomalies.

Critical systems may be backed up according to their operational requirements.

Backups are protected using appropriate access and security controls.

Recovery procedures are reviewed and tested as appropriate.

Systems and dependencies that are no longer supported or required should be:

1. upgraded;
2. replaced;
3. isolated; or
4. decommissioned.

Infrastructure and dependencies may be reviewed periodically and following:

1. major architecture changes;
2. significant vulnerabilities;
3. security incidents;
4. material third-party changes; or
5. changes to applicable security requirements.