How Coldreach protects your data.
Information Security Policy last reviewed July 4, 2026. Next review July 4, 2027.
Infrastructure and hosting
All Coldreach data is hosted on Google Cloud Platform. Cloud infrastructure and systems are continuously monitored to detect misconfigurations, vulnerabilities and unauthorized activity. Changes to production systems are documented and approved before release.
Data protection
Sensitive data is encrypted in transit (TLS/HTTPS) and at rest, and stored only in approved systems. We run secure backup procedures. Information is classified into four tiers: public, internal, confidential and restricted. Customer data is treated as confidential, with access limited to authorized personnel. Encryption keys and credentials are restricted, with additional safeguards and logging.
Access control
Multi-factor authentication is enforced across our systems. Access follows least-privilege, role-based rules and permissions are reviewed regularly. Confidential or restricted data is never shared outside Coldreach without a non-disclosure agreement and proper authorization.
People and secure development
Everyone at Coldreach completes security awareness training at onboarding, covering phishing prevention, password hygiene and incident reporting. Engineers follow secure development lifecycle practices and complete secure coding training.
Incident response
A documented Incident Response Policy covers how we prepare for, respond to and recover from security events. The CTO leads response; if the CTO is unavailable, the CEO assumes responsibility. Suspected incidents are reported immediately to the CTO and engineering. The policy is available to customers under NDA.
Vendors and subprocessors
We assess threats and vulnerabilities regularly and perform risk reviews on the vendors that process customer data. A current list of subprocessors is available on request, and we notify customers before adding a new one as set out in our Data Processing Agreement.
Policies and documents
Security questions
For security reviews, vendor questionnaires, DPAs or to report a vulnerability, email us. A founder reads every message.