Welcome to https://app.alignvu.io/ (the ‘Application’). The Application provides Global Sanction List reconciliation, monitoring and assessment of government sourced against a number of value add Sanction List Aggregator data sets as well as customer internal sanction lists (the ‘Services’).
The Application is operated by ATTAIN Group Limited (a UK company Reg 3810856) trading as alignVu. Access to and use of the Application, or any of its associated Products or Services, is provided by alignVu. Please read these terms and conditions (the ‘Terms’) carefully. By using, browsing and/or reading the Application, this signifies that you have read, understood and agree to be bound by the Terms. If you do not agree with the Terms, you must cease usage of the Application, or any of Services, immediately.
alignVu reserves the right to review and change any of the Terms by updating this page at its sole discretion. When alignVu updates the Terms, it will use reasonable endeavours to provide you with notice of updates to the Terms. Any changes to the Terms take immediate effect from the date of their publication. Before you continue, we recommend you keep a copy of the Terms for your records.
You accept the Terms by using the Application. You may also accept the Terms by clicking to accept or agree to the Terms where this option is made available to you by alignVu in the user interface.
In order to access the Services, you must first register (‘Register’) to use the Application. This provides access to alignVu, and a number of freely available Global Sanction Lists from government agencies. Upon registration you may then purchase a subscription through the Application (the ‘Subscription’) and pay the applicable fee for the selected Subscription (the ‘Subscription Fee’).
In purchasing the Subscription, you acknowledge and agree that it is your responsibility to ensure that the Subscription you elect to purchase is suitable for your use.
Once you have purchased the Subscription, you will then be required to register for an account through the Application before you can access the Services (the ‘ Account’).
As part of the registration process, or as part of your continued use of the Services, you may be required to provide personal information about yourself (such as identification or contact details), including:
You warrant that any information you give to alignVu in the course of completing the registration process will always be accurate, correct and up to date.
Once you have completed the registration process, you will be a subscriber of the Application (‘Subscriber’) and agree to be bound by the Terms. As a Subscriber you will be granted immediate access to the Services from the time you have completed the registration process until the subscription period expires (the ‘Subscription Period’).
You may not use the Services and may not accept the Terms if:
As a Subscriber, you agree to comply with the following:
You have the sole responsibility for protecting the confidentiality of your password and/or email address. Use of your password by any other person may result in the immediate cancellation of the Services;
Any use of your registration information by any other person, or third parties, is strictly prohibited. You agree to immediately notify alignVu of any unauthorized use of your password or email address or any breach of security of which you have become aware;
Access and use of the Application is limited, non-transferable and allows for the sole use of the Application by you for the purposes of alignVu providing the Services;
You will not use the Services or the Application in connection with any commercial endeavours except those that are specifically endorsed or approved by the management of alignVu and the compliance with the AML/CTF laws and regulations;
You will not use the Services or Application for any illegal and/or unauthorized use which includes collecting email addresses of Subscribers by electronic or other means for the purpose of sending unsolicited email or unauthorized framing of or linking to the Application;
You agree that commercial advertisements, affiliate links, and other forms of solicitation may be removed from the Application without notice and may result in termination of the Services. Appropriate legal action will be taken by alignVu for any illegal or unauthorized use of the Application; and
You acknowledge and agree that any automated use of the Application or its Services is prohibited unless via the connect SaaS provided through alignVu
alignVu will provide you with the Services detailed in the Subscription in accordance with the terms set out in these Terms of Use.
alignVu will use reasonable endeavours to provide the Services in accordance with any timetable agreed with you. However, you acknowledge and accept that any dates given by alignVu are estimates only and that delivery of the Services will be dependent upon your timely cooperation with alignVu as well as other factors outside of alignVu’s reasonable control.
You acknowledge and accept that occasionally alignVu, in providing the Services, may be required to:
You shall be responsible for:
You shall comply with these Terms and all relevant Additional Terms where applicable.
You must ensure that any software, equipment and materials which are used with the Services:
The Services are provided solely for your internal business purpose, and as part of this service, you may share the information with your clients. You must not resell or attempt to resell the Services (or any part or facility of it, including the Output Material) to any third party without first entering into an appropriate agreement signed by an authorized representative of alignVu.
You must not use the Services for the purposes of verifying the identity of Data Subjects where you do not have the relevant permission or consent from the Data Subject in accordance with the Privacy and Data Protection Requirements.
The Services are protected by Intellectual Property Rights. You must not copy, store, adapt, modify, transmit, or distribute the Services except to Permitted Subscribers or permit anyone else to do the same.
You shall be responsible for the creation, maintenance, and design of all Subscriber Information.
You warrant that you shall comply with all applicable legislation, instructions, and guidelines issued by regulatory authorities, relevant licenses, and any other codes of practice that apply to you and your use of the Services, including those which relate to the provision of Subscriber Information.
You are responsible for the acts and omissions of all Permitted Subscribers of the Services and are liable for any failure by a Permitted Subscriber to perform or observe these Terms.
If you use the Services in contravention of this clause, and the contravention is not remedied within 10 business days, then alignVu shall be entitled to treat the contravention as a material breach of these Terms and terminate your Subscription.
You are responsible for the security and proper use of all user identities (“Subscriber IDs”) and passwords used in connection with the Services (including changing passwords on a regular basis).
You shall take all reasonably necessary steps to ensure that Subscriber IDs are kept confidential, secure, are used properly, and are not disclosed to any unauthorized parties. For the avoidance of doubt, you will be responsible for all Charges for the Services where your Subscriber ID has been used to access the Services.
You must immediately inform alignVu if there is any reason to believe that a Subscriber ID or password has or is likely to become known to someone not authorized to use it or is being or is likely to be used in an unauthorized way.
alignVu reserves the right to suspend the Subscriber ID and password access to the Services if at any time alignVu reasonably considers that there is or is likely to be a breach of security or misuse of the Services and/or to require you to change any or all of the passwords used by you in connection with the Services.
The alignVu security and development teams shall use all of the following measures to detect vulnerabilities that may arise in alignVu’s information systems.
The alignVu security team shall evaluate the severity of every detected vulnerability in terms of the likelihood and potential impact of an exploit and shall develop mitigation strategies and schedules accordingly. Suitable mitigations include complete remediation or implementing compensating controls.
The alignVu security team maintains an internal Incident Response Policy which contains steps for preparation, identification, containment, investigation, eradication, recovery, and follow-up/postmortem.
The alignVu security team shall use all of the following measures to detect security incidents.
In addition to personal data (“subscriber”), there is other data types available through alignVu;
In some cases, the source data have errors which we have not yet detected and in other cases the data has been provided in very complex and impenetrable formats, which may have given rise to errors in the way it is presented on alignVu
Therefore, we cannot make any promises as to the quality of company data. You use data in its original form entirely at your own risk. For this reason, and because Original Records of Interest are made available without charge from their source, we limit our liability as follows
alignVu acts as a data processor for these data types which it provides as a service to its subscribers. These records are aligned, verified, tracked, monitored and assessed and anomaly reports and alerts are provided to subscribers that inform subscribers as to the conformity, consistency, accuracy and freshness of each record from initial publication to the point available to screening system.
How does alignVu manage data classifications and data processing?
alignVu maintains the following Data Confidentiality Levels:
Data Confidentiality is determined by:
Additionally, data may be separated into data type classifications to enforce processing rules for customer data. For each data class, the alignVu security and development teams may provision and dedicate specific information systems in Amazon Web Services to store and process data of that class, and only data of that class, unless otherwise explicitly stated. For all classes of customer data, data must be encrypted at rest and in transit. Corresponding systems may store, and process data items needed to keep each customer’s data properly segmented, such as alignVu customer identifiers.
Customer Subscriber Account Data – This is data pertaining to login accounts for the alignVu Application, used by alignVu customers. Subscriber account credentials shall be hashed in such a manner that the plaintext passwords cannot be recovered.
Customer Contact Data – This is contact data about alignVu customers and customer agents.
Customer Preferences Data – This is data pertaining to the customer-specific preferences and configurations of the alignVu service made by customer agents.
Customer Recorded Data – This is data that the alignVu service collects during session recording.
Customer Event Transaction Metadata – This is metadata about transactions conducted on all other classes of customer data. This includes customer organization and user identifiers, standard syslog data pertaining to customer users, and instances of Customer Contact Data and Customer Preferences Data. This class does not include Customer Recorded Data.
Customer Contact Data, Customer Preferences Data, and Customer Event Transaction Metadata may be stored and processed in systems hosted in environments other than Amazon Web Services, as approved by the security team.
Resources must maintain accurate data classification tagging policies for their entire lifecycle, including during decommissioning or when removed from service temporarily.
alignVu employees may access Customer Data only under the following conditions.
alignVu provides web user interfaces (UIs), application programming interfaces (APIs), and data export facilities to provide customers access to their data.
The security team in conjunction with executive management may approve emergency exceptions to any of the above rules, in response to security incidents, service outages, or significant changes to the alignVu operating environment, when it is deemed that such exceptions will benefit and protect the security and mission of alignVu, alignVu customers, and visitors of alignVu customers’ websites.
alignVu protects all data in transit with TLS 1.2 and all data at rest with AES-256 encryption from Amazon KMS. Cryptographic keys are assigned to specific roles based on least privilege access and keys are automatically rotated yearly. Usage of keys is monitored and logged.
Resources must maintain data encryption at rest and in transit for their entire lifecycle, including during decommissioning or when removed from service temporarily.
Each customer is responsible for the information they create, use, store, process and destroy.
On expiration of services, customers may instruct alignVu to delete all customer data from alignVu’s systems in accordance with applicable law as soon as reasonably practicable, unless applicable law or regulations require otherwise.
alignVu uses Amazon Web Services for all infrastructure. AWS provides the following guidance regarding their data lifecycle policies:
Media storage devices used to store customer data are classified by AWS as Critical and treated accordingly, as high impact, throughout their life cycles. AWS has exacting standards on how to install, service, and eventually destroy the devices when they are no longer useful. When a storage device has reached the end of its useful life, AWS decommissions media using techniques detailed in NIST 800-88. Media that stored customer data is not removed from AWS control until it has been securely decommissioned.
How does alignVu detect, and respond to vulnerabilities and security incidents?
The alignVu security and development teams shall use all of the following measures to detect vulnerabilities that may arise in alignVu’s information systems.
The alignVu security team shall evaluate the severity of every detected vulnerability in terms of the likelihood and potential impact of an exploit and shall develop mitigation strategies and schedules accordingly. Suitable mitigations include complete remediation or implementing compensating controls.
The alignVu security team maintains an internal Incident Response Policy which contains steps for preparation, identification, containment, investigation, eradication, recovery, and follow-up/postmortem.
The alignVu security team shall use all of the following measures to detect security incidents.
How will alignVu prevent and recover from events that could interfere with expected operations?
alignVu services shall be configured in such a manner so as to withstand long-term outages to individual servers, availability zones, and geographic regions. alignVu infrastructure and data is replicated in multiple geographic regions to ensure this level of availability. alignVu availability and status information can be found at status.clickup.com.
alignVu targets a Data Recovery Point Objective (RPO) of near-zero for at least 7 days, and up to 24 hours beyond 7 days.
Due to the distributed nature of alignVu services, Recovery Time Objectives (RTO) are near-zero for geographic disasters. RTO for systemic disasters involving data recovery is targeted at 6 hours.
alignVu tests backup and recovery processes on at least a monthly basis.
Business Risk Assessment and Business Impact Analysis
alignVu’s risk assessment committee will include business risk assessment and business impact analysis for each Key Business System that is used by the organization. The outcome of ongoing risk assessments will update or create recovery plans for Key Business Systems and update prioritization of systems compared to other key systems.
alignVu prioritizes policies, tools, and equipment which enables independent, distributed remote work for all staff if emergencies or disasters strike. If the organization’s primary work site is unavailable, staff can work from home or an alternate work site shall be designated by management.
alignVu has established internal communications using secure, distributed providers using industry standard security protocols. Staff and management will be notified via existing channels during any emergency event, or when any data recovery plan is initiated or deactivated.
alignVu’s total liability arising out of or in connection with the Services or these Terms, however arising, including under contract, tort (including negligence), in equity, under statute or otherwise, will not exceed the resupply of the Services to you.
You expressly understand and agree that alignVu, its affiliates, employees, agents, contributors and licensors shall not be liable to you for any direct, indirect, incidental, special consequential or exemplary damages which may be incurred by you, however caused and under any theory of liability. This shall include, but is not limited to, any loss of profit (whether incurred directly or indirectly), any loss of goodwill or business reputation and any other intangible loss.
EU-U.S. Privacy Shield Framework
While we acknowledge that the EU-US Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personal information from European Union member countries may no longer be a valid transfer mechanism for data transfers to the European Economic Area, we nevertheless comply with the principles contained therein as additional measures to protect our users’ privacy alignVu adheres to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability. If there is any conflict between the policies in this Privacy Policy and the Privacy Shield Principles, the more restrictive policy shall govern.
By using the Services, you acknowledge that these terms and conditions govern your use of the Services, and that additional terms and conditions apply to the use of the data transmitted as part of the Services. Accordingly:
If a third-party Data Provider imposes any restrictions or conditions of use on you pursuant to that third-party Data Provider’s agreement with alignVu, we reserve the right to impose these conditions on you, and you agree to comply with them.
You are responsible for obtaining the consent of each Data Subject for the provision of the Services.
Without limiting your obligations under these Terms of Use, you must:
Comply with other reasonable product compliance requirements, which alignVu may notify you of from time to time.
Where the option is given to you, you may make payment of the Subscription Fee by way of:
You acknowledge and agree that where a request for the payment of the Subscription Fee is returned or denied, for whatever reason, by your financial institution or is unpaid by you for any other reason, then you are liable for any costs, including banking fees and charges, associated with the Subscription Fee.
You agree and acknowledge that alignVu can vary the Subscription Fee at any time and that the varied Subscription Fee will come into effect following the conclusion of the existing Subscription Period.
alignVu will only provide you with a refund of the Subscription Fee in the event they are unable to continue to provide the Consultancy or Services or if the manager of alignVu makes a decision, at its absolute discretion, that it is reasonable to do so under the circumstances. Where this occurs, the refund will be in the proportional amount of the Subscription Fee that remains unused by the Subscriber (the ‘Refund’).
The Application, the Services and all of the related products of alignVu are subject to copyright. The material on the Application is protected by copyright under the laws of Australia and through international treaties. Unless otherwise indicated, all rights (including copyright) in the Services and compilation of the Application (including but not limited to text, graphics, logos, button icons, video images, audio clips, Application, code, scripts, design elements and interactive features) or the Services are owned or controlled for these purposes, and are reserved by alignVu or its contributors.
All trademarks, service marks and trade names are owned, registered and/or licensed by alignVu, who grants to you a worldwide, non-exclusive, royalty-free, revocable license whilst you are a Subscriber to:
alignVu does not grant you any other rights whatsoever in relation to the Application or the Services. All other rights are expressly reserved by alignVu.
alignVu retains all rights, title and interest in and to the Application and all related Services. Nothing you do on or in relation to the Application will transfer any:
If, as a result of these Terms of Use, you are able to access any information about identifiable individuals held by or on behalf of alignVu (which is a trading name of the Attain Group Ltd ), then you:
“Associated Company” includes any firm, company, corporation or other organisation which:
This Privacy Policy applies to all data subjects whose personal data controlled by alignVu and/or or to your use the Application. Our website contain links only to other websites provided by verifiable government department. We will take all reasonable steps to ensure that your data will be handled safely, securely, and in accordance with your rights, Our obligations, and the obligations of the third party under the law. Please note that We have no control over how your data is collected, stored, or used by third party processors and other websites and We advise you to check the privacy policies of any such websites before providing any data to them.
As a data subject, you have the following rights under the GDPR, which this Policy and Our use of personal data have been designed to uphold:
If you have any cause for complaint about Our use of your personal data, please contact Us by contacting our Data Protection Officer using the contact details outlined above.
We will do Our best to solve the problem for you. If We are unable to help, you also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office.
For further information about your rights, please contact the Information Commissioner’s Office
Depending upon your relationship to Us and/or your use of Our website (including our Careers page), We may collect some or all of the following personal data (please also see the Cookie Policy on our website at https://attain.uk.com/cookie-policy/ on Our use of Cookies and similar):
This Privacy Policy applies to all data subjects whose personal data controlled by alignVu and/or or to your use the Application. Our website contain links only to other websites provided by verifiable government department. We will take all reasonable steps to ensure that your data will be handled safely, securely, and in accordance with your rights, Our obligations, and the obligations of the third party under the law. Please note that We have no control over how your data is collected, stored, or used by third party processors and other websites and We advise you to check the privacy policies of any such websites before providing any data to them.
As a data subject, you have the following rights under the GDPR, which this Policy and Our use of personal data have been designed to uphold:
If you have any cause for complaint about Our use of your personal data, please contact Us by contacting our Data Protection Officer using the contact details outlined above.
We will do Our best to solve the problem for you. If We are unable to help, you also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office.
For further information about your rights, please contact the Information Commissioner’s Office
Depending upon your relationship to Us and/or your use of Our website (including our Careers page), We may collect some or all of the following personal data (please also see the Cookie Policy on our website at https://attain.uk.com/cookie-policy/ on Our use of Cookies and similar):
We only keep your personal data for as long as We need to in order to use it as described above in section 6, and/or for as long as We have your permission to keep it.
All of your data will be stored in the UK and ensure that your data is treated safely and securely under the Data Protection Act 2018 and GDPR including:
Data security is very important to Us, and to protect your data We have taken suitable measures to safeguard and secure personal data. Steps We take to secure and protect your data include:
In certain circumstances, we may be legally required to share certain data held by Us, which may include your personal data, for example, where We are involved in legal proceedings, where We are complying with legal obligations, a court order, or a governmental authority.
We may compile statistics about the use of application and including data on traffic, usage patterns, user numbers, sales, and other information. All such data will be anonymised and will not include any personally identifying data, or any anonymised data that can be combined with other data and used to identify you. We may from time to time share such data with third parties such as prospective investors, affiliates, partners, and advertisers. Data will only be shared and used within the bounds of the law.
We may, from time to time, expand or reduce Our business and this may involve the sale and/or the transfer of control of all or part of Our business or those of our Associated Companies. Any personal data that you have provided will, where it is relevant to any part of Our business that is being transferred, may be transferred along with that part and the new owner or newly controlling party will, under the terms of this Privacy Policy, be permitted to use that data only for the same purposes for which it was originally collected by Us.
In the event that any of your data is to be transferred in such a manner, all efforts will be made to contact you in advance and inform you of the changes. When contacted you may be given the choice to have your data deleted or withheld from the new owner or controller.
You may access certain areas of the Marketing Website without providing any data at all. However, to use all features and functions available on the Marketing Website you may be required to submit or allow for the collection of certain data.
You may restrict Our use of Cookies. For more information, see Our Cookie Policy https://attain.uk.com/cookie-policy/.
You may request to restrict the processing of personal data routinely collected for the purpose of establishing and fulfilling a contract; where it is possible to fulfil the contract without such information, and where permitted by law, We will comply to written requests to withhold, delete or limit the processing of your personal data.
You have the right to ask for a copy of any of your personal data held by Us (where such data is held). Under the GDPR, no fee is payable, and We will provide any and all information in response to your request free of charge, unless responding to it is likely to be complex and will involve looking extensively at a high volume of data, in which case you will be notified of the relevant fee involved. Please contact Us for more details at data.protection@attain.uk.com.
We may change this Privacy Policy from time to time (for example, if the law changes). Any changes will be immediately posted on Marketing Website and you will be deemed to have accepted the terms of the Privacy Policy on your first use of Marketing Website following the alterations or continuation of your relationship with Us. We recommend that you check this page regularly to keep up-to-date.
Nothing in the Terms limits or excludes any guarantees, warranties, representations or conditions implied or imposed by UK law (or any liability under them) which by law may not be limited or excluded.
Subject to this clause, and to the extent permitted by law:
Use of the Application and the Services is at your own risk. Everything on the Application and the Services is provided to you “as is” and “as available” without warranty or condition of any kind. None of the affiliates, directors, officers, employees, agents, contributors and licensors of alignVu make any express or implied representation or warranty about the Services or any products or Services (including the products or Services of alignVu) referred to on the Application. includes (but is not restricted to) loss or damage you might suffer as a result of any of the following:
The Terms will continue to apply until terminated by either you or by alignVu as set out below.
If you want to terminate the Terms, you may do so by:
alignVu may at any time, terminate the Terms with you if:
Subject to local applicable laws, alignVu reserves the right to discontinue or cancel your membership at any time and may suspend or deny, in its sole discretion, your access to all or any portion of the Application or the Services without notice if you breach any provision of the Terms or any applicable law or if your conduct impacts alignVu’s name or reputation or violates the rights of those of another party.
You agree to indemnify alignVu, its affiliates, employees, agents, contributors, third party content providers and licensors from and against:
Compulsory: If a dispute arises out of or relates to the Terms, either party may not commence any Tribunal or Court proceedings in relation to the dispute, unless the following clauses have been complied with (except where urgent interlocutory relief is sought).
Notice: A party to the Terms claiming a dispute (‘Dispute’) has arisen under the Terms, must give written notice to the other party detailing the nature of the dispute, the desired outcome and the action required to settle the Dispute.
Resolution: On receipt of that notice (‘Notice’) by that other party, the parties to the Terms (‘Parties’) must:
The mediation will be held in London, United Kingdom.
Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with the Contract or its subject matter or formation.
The Terms and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation shall be governed by and construed in accordance with the law of England and Wales.
If any part of these Terms is found to be void or unenforceable by a Court of competent jurisdiction, that part shall be severed, and the rest of the Terms shall remain in force.
alignVu employs strict security standards and measures throughout the entire organization. Every team member is trained and kept up to date on the latest security protocols. We regularly undergo testing, training, and auditing of our practices and policies.
What is this document, why does it exist, what does it cover, and who is in charge of it?
This policy defines behavioural, process, technical, and governance controls pertaining to security at alignVu that all personnel are required to implement in order to ensure the confidentiality, integrity, and availability of the alignVu service and data (“Policy”). All personnel must review and be familiar with the rules and actions set forth below.
This Policy defines security requirements for:
In the event of a conflict, the more restrictive measures apply.
This Policy was created in close collaboration with and approved by alignVu executives. At least annually, it is reviewed and modified as needed to ensure clarity, sufficiency of scope, concern for customer and personnel interests, and general responsiveness to the evolving security landscape and industry best practices.
The alignVu security team oversees the implementation of this Policy, including
The security team maintains a Risk Management Framework derived from NIST SP 800-39 – “Managing Information Security Risk: Organization, Mission, and System View” and NIST SP 800-30 – “Guide for Conducting Risk Assessments”. Risk assessment exercises inform prioritization for ongoing improvements to alignVu’s security posture, which may include changes to this Policy itself.
Our Risk Management Framework incorporates the following:
What are alignVu’s expectations of its personnel and the workplace regarding systems and data?
alignVu is committed to protecting its customers, personnel, partners, and the company from illegal or damaging actions by individuals, either knowingly or unknowingly in the context of its established employment culture of openness, trust, maturity, and integrity.
This section outlines expected personnel behaviours affecting security and the acceptable use of computer systems at alignVu. These rules are in place to protect our personnel and alignVu itself, in that inappropriate use may expose customers and partners to risks including malware, viruses, compromise of networked systems and services, and legal issues.
The first line of defence in data security is the informed behaviour of personnel, who play a significant role in ensuring the security of all data, regardless of format. Such behaviours include those listed in this section as well as any additional requirements specified in the employee handbook, specific security processes, and other applicable codes of conduct.
All employees and contractors must complete the alignVu security awareness and data handling training programs at least annually.
It is the responsibility of all personnel to take positive action to maintain physical security. Challenge any unrecognized person present in a restricted office location. Any challenged person who does not respond appropriately should be immediately reported to supervisory staff and the security team. All visitors to alignVu offices must be registered as such or accompanied by a alignVu employee.
Personnel should maintain workspaces clear of sensitive or confidential material and take care to clear workspaces of such material at the end of each workday.
Unattended devices must be locked. All devices will have an automatic screen lock function set to automatically activate upon no more than fifteen minutes of inactivity.
Systems are to be used for business purposes in serving the interests of the company, and of our clients and partners in the course of normal business operations. Personnel are responsible for exercising good judgment regarding the reasonableness of personal use of systems. Only alignVu-managed hardware and software is permitted to be connected to or installed on corporate equipment or networks and used to access alignVu data. alignVu-managed hardware and software includes those either owned by alignVu or owned by alignVu personnel but enrolled in an alignVu device management system. Only software that has been approved for corporate use by alignVu may be installed on corporate equipment. All personnel must read and understand the list of prohibited activities outlined in this Policy. Modifications or configuration changes are not permitted without explicit written consent by the alignVu security team.
Use of removable media such as USB drives is prohibited. Personnel may not configure work devices to make backups or copies of data outside corporate policies. Instead, personnel are expected to operate primarily “in the cloud” and treat local storage on computing devices as ephemeral. alignVu data must be saved to company-approved secure cloud storage (e.g. Google Docs) to ensure that even in the event of a corporate device being lost, stolen, or damaged, such artifacts will be immediately recoverable on a replacement device.
The following activities are prohibited. Under certain conditions and with the explicit written consent of the security team, personnel may be exempted from certain of these restrictions during the course of their legitimate job responsibilities (e.g. planned penetration testing, systems administration staff may have a need to disable the network access of a host if that host is disrupting production services).
The list below is by no means exhaustive, but attempts to provide a framework for activities which fall into the category of unacceptable use.
Centralized System Configuration – Personnel devices and their software configuration are managed remotely by members of the security team via configuration-enforcement technology, also known as MDM software. Such technology may be used for purposes including auditing/installing/removing software applications or system services, managing network configuration, enforcing password policy, encrypting disks, remote wipe & recovery, copying data files to/from employee devices, and any other allowed interaction to ensure that employee devices comply with this Policy.
Data and Device Encryption – All devices must use modern full disk encryption to protect data in the event of a lost device. An example of valid full disk encryption is Apple FileVault 2 using XTS-AES-128 encryption with a 256-bit key. This is enforced using MDM software.
Device Heartbeat and Remote Wipe – Devices must support the ability to report their status and be remotely wiped. This is enforced using MDM software.
Prevent Removable Storage – Devices must prevent usage of removable storage. This is enforced using MDM software.
Endpoint/Antivirus/Antimalware Protection – Devices must automatically install and configure the alignVu provided antivirus software for endpoint protection. Configured software will report status and potential threats, allowing for remote administration and reporting by the security team. This is enforced using MDM software.
Retention of Ownership – All software programs, data, and documentation generated or provided by personnel while providing services to alignVu or for the benefit of alignVu are the property of alignVu unless otherwise covered by a contractual agreement.
Personnel Privacy – While alignVu’s network administration desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of alignVu. Due to the need to protect alignVu’s network, management does not intend to guarantee the privacy of personnel’s personal information stored on any network device belonging to alignVu. Personnel are responsible for exercising good judgment regarding the reasonableness of personal use such as general web browsing or personal email. If there is any uncertainty, personnel should consult the security team or their manager.
Personnel should structure all electronic communication with recognition of the fact that the content could be monitored and that any electronic communication could be forwarded, intercepted, printed, or stored by others.
alignVu reserves the right, at its discretion, to review personnel’s files or electronic communications to the extent necessary to ensure all electronic media and services are used in compliance with all applicable laws and regulations as well as corporate policies.
alignVu reserves the right to audit networks and systems on a periodic basis to ensure compliance with this policy. For security and network maintenance purposes, authorized individuals within alignVu may monitor equipment, systems and network traffic at any time.
Background Checks – Background checks are conducted for personnel with access to production infrastructure prior to their start date. The consequences of problematic background check results may range from a limitation of security privileges, to revocation of employment offer, to termination.
Training – The security team maintains a company-wide security awareness program delivered to all personnel at least annually. The program covers security awareness, policies, processes, and training to ensure that personnel are sufficiently informed to meet their obligations. Those most responsible for maintaining security at alignVu, including the security team itself as well as key engineering/operations staff, undergo more technical continuing education.
Separation – In the case of personnel termination or resignation, the security team coordinates with human resources to implement a standardized separation process to ensure that all accounts, credentials, and access of outgoing employees are reliably disabled.
Access to alignVu offices is mediated by a staffed front office and programmable door control access. All doors shall remain locked or staffed under normal business conditions. The security team may provide approval to unlock doors for short periods of time in order to accommodate extenuating physical access needs.
Internet-based security cameras are positioned to record time-stamped video of ingress/egress, which are stored off-site.
Internet access shall be provided to devices via wired ethernet and WPA2 wifi. Networking switches and routers shall be placed in a locked networking closet with only the security team having access. alignVu executives and the security team may grant access to the networking closet to individuals on a case-by-case and as-needed basis. A network firewall that blocks all WAN-sourced traffic shall be put in place. WAN-accessible network services shall not be hosted within the office environment.
How does alignVu define, control, and maintain user identity and permissions for personnel?
Each individual having access to any alignVu controlled system does so via an account denoting their system identity. Such user accounts are required to have a unique username, a unique strong password of at least 8 characters, and a two-factor authentication (2FA) mechanism.
Logins by personnel may originate only from alignVu-managed devices. Authentication is performed by Google’s account management system for registration and by the alignVu portal for subscription, details of which can be found at https://gsuite.google.com/security. alignVu leverages G Suite’s facilities of detecting malicious authentication attempts. Repeated failed attempts to authenticate may result in the offending user account being locked or revoked.
Whenever available, third-party systems must be configured to delegate authentication to alignVu’s account authentication system (described above) thereby consolidating authentication controls into a single user account system that is centrally managed by the security team. This enforces the creation of unique strong passwords and stored in the alignVu approved password management system. Passwords must be paired with two-factor/MFA authentication.
Subscriber accounts are revoked (that is, disabled but not deleted) immediately upon personnel separation. As a further precaution, all user accounts are audited at least quarterly, and any inactive user accounts are revoked.
alignVu adheres to the principle of least privilege, and every action attempted by a user account is subject to access control checks.
alignVu employs a role-based access control (RBAC) model that facilitates organizational units, user accounts, user groups, and sharing controls.
alignVu may require use of a specified web browser(s) for normal business use and for access to corporate data such as email. For certain specified roles such as software development and web design, job activities beyond those mentioned above necessitate the use of a variety of browsers, and these roles may do so as needed for those activities.
Any browser that is allowed to access corporate data such as email is subject to a whitelist-based restriction on which browser extensions can be installed.
Access to administrative operations is strictly limited to security team members and further restricted still as a function of tenure and the principle of least privilege.
Access control policies are reviewed regularly with the goal of reducing or refining access whenever possible. Changes in job function by personnel trigger an access review as well.
Upon termination of personnel, whether voluntary or involuntary, the security team will follow alignVu’s personnel exit procedure, which includes revocation of the associated user account and reclamation of company-owned devices, office keys or access cards, and all other corporate equipment and property prior to the final day of employment.
How does alignVu build, adopt, configure, and maintain technology to fulfil its security intentions?
alignVu stores source code and configuration files in private GitHub repositories. The security and development teams conduct code reviews and execute a static code analysis tool on every code commit. Reviewers shall check for compliance with alignVu’s conventions and style, potential bugs, potential performance issues, and that the commit is bound to only its intended purpose.
Security reviews shall be conducted on every code commit to security-sensitive modules. Such modules include those that pertain directly to authentication, authorization, access control, auditing, and encryption.
All major pieces of incorporated open source software libraries and tools shall be reviewed for robustness, stability, performance, security, and maintainability.
The security and development teams shall establish and adhere to a formal software release process.
Sensitive data which does not need to be decrypted (e.g. passwords) is salted and hashed using approved functions such as Bcrypt.
Sensitive data which must be decrypted (e.g. tokens) must use an approved encryption provider for HSM functions, such as KMS.
The alignVu security and development teams shall document the configuration of all adopted systems and services, whether hosted by alignVu or are third party hosted. Industry best practices and vendor-specific guidance shall be identified and incorporated into system configurations. All configurations shall be reviewed on at least an annual basis. Any changes to configurations must be approved by appointed individuals and documented in a timely fashion.
System configurations must address the following controls in a risk-based fashion and in accordance with the remainder of this policy:
alignVu and the Attain Group take security and compliance seriously and understands its significance to both customers and partners. For this reason, all alignVu services have certifications with the AICPA’s SOC for Service Organizations, SOC 2 Type II and SOC 3.
alignVU utilises Amazon Web Services (AWS) as its cloud based application service provider and leverages AWS’ security and compliance controls for data centre physical security and cloud infrastructure. Further resources for this service provider can be found on the AWS Security Cloud website
The IT infrastructure that AWS provides to its customers is designed and managed in alignment with best security practices and a variety of IT security standards. The following is a partial list of assurance programs with which AWS complies:
© 2023 Alignvu
Registration provides you with access to more than 50 regulator, PEP and financial crime datafeeds in there created format and updates.
