Information Security and Data Protection Policy

1. Principles

1.1 The client owns its systems, accounts, containers, properties, projects and data, and keeps administrative control, including the ability to remove our access without our help.

1.2 We collect, use and keep only what the approved purpose needs, and we keep it only as long as it is needed.

1.3 We do not use client data for profiling, re-identification, advertising, product development or training or tuning AI models without the client's prior written approval.

2. Access and identity

2.1 Least privilege: we ask for and use only the access the task needs, and we give it up when the task ends.

2.2 Individual accounts: each person uses their own named account. We never share credentials, and we do not hold privileged accounts that belong to us on a client's systems when the client can issue accounts.

2.3 Strong authentication: multi-factor authentication, phishing-resistant where the system supports it, is required for every privileged account and for access from outside a client's trusted network. We use single sign-on and do not use long-lived static cloud keys.

2.4 We review access at least every quarter and on any change of role or end of work, and we remove what is not needed at once.

2.5 Secrets such as passwords, tokens and keys are kept in an encrypted vault or secret manager and never in code, tickets, chat or documents.

3. Information protection

3.1 We use encryption in transit (TLS 1.2 or later, with HTTP Strict Transport Security on what we build) and at rest for personal or sensitive data.

3.2 Personal data is not put in URLs, logs or analytics events unless the client has approved it. We use pseudonymized or synthetic data in development and testing, and we do not test with real personal data.

3.3 We store and process client data only in locations the client approves, and we do not send it to any platform, subcontractor or third party the client has not approved.

3.4 Devices that hold client information are encrypted, locked, kept up to date and protected from malicious code, and are wiped when they leave use.

4. Secure delivery and change control

4.1 We separate development, testing and production, and we do not install development tools on production.

4.2 Every change to a client system has a purpose, the affected assets, a test result, an approver and a way back. We keep a restorable version before each production change, and the client can restore it and suspend our publishing rights without us.

4.3 Custom code, arbitrary scripts, external scripts and changes to data collection or consent settings need written justification, a second check and the client's approval before release.

4.4 We apply security by design, keep code under version control, and apply critical patches through the change process.

4.5 We run security tests before a launch and at least once a year on what we deploy for a client, and we send the results and the fixes to the client's security contact.

5. Logging and monitoring

5.1 Account, permission, container, tag, script, service-account and credential changes are logged with who, when, what and the publication status. The person who made a change cannot edit or delete the record of it.

5.2 The client has its own access to those logs. We watch for unexpected changes of privilege, multi-factor settings, administrators, scripts and credentials, and alert the client's security contact.

6. Incidents

6.1 We tell the client at once of any actual or suspected incident that could give access to its systems or data, including a compromise of our own accounts, devices, credentials or deployment tools, or those of a subcontractor. We do not wait to know the full scope or the cause.

6.2 We contain first, preserve evidence, help with revocation, rollback, recovery and root-cause analysis, and give the client a written report.

6.3 Everyone who works for MotionInk must report a suspected incident at once, to lucas@motionink.ai or hello@motionink.ai. If the concern involves the owner or a client engagement, or the person prefers, they may report straight to the client's own security or ethics office or, for work with the United Nations, to the Office of Internal Audit and Investigations of UNICEF, through the channels published on unicef.org.

7. Privacy and law

7.1 We follow the data-protection laws that apply to each engagement, including the Dominican Republic's Law 172-13 on the protection of personal data and, where they apply, the General Data Protection Regulation and similar laws. Their principles guide us everywhere: lawfulness, fairness, purpose limitation, minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.

7.2 We act on the client's instructions. We sign a data-processing or data-sharing agreement when an engagement involves personal data, and we help the client answer requests from the people concerned.

7.3 We keep a record of the personal data we process for each client and where it is held.

8. Retention and deletion

8.1 At the end of an engagement we return or securely delete client data and remove our access, unless the contract or the law requires us to keep it. We confirm in writing when we have done it.

9. Suppliers and subcontractors

9.1 We give a subcontractor access only after it accepts this policy in writing. We stay responsible for its actions, and our incident duty covers it.

9.2 We choose cloud and software providers with care and keep a list of those that touch client data.

10. Awareness, responsibility and review

10.1 Everyone who works for MotionInk reads this policy before they touch client data, and again after each material change.

10.2 The owner is responsible for this policy, reviews it at least once a year and after any incident, and records the review. We do not hold an information-security certification, and we do not claim one.