Security

1. Overview

Phoenix Software Inc. (“Phoenix”) places the highest priority on the security, confidentiality and integrity of Customer data. This page describes the technical safeguards, infrastructure design and operational practices that protect data processed and stored within the Phoenix platform. It forms part of our Privacy Policy and is referenced in our Customer agreements.

Our platform is built on Amazon Web Services (AWS) global cloud infrastructure and designed with reference to internationally recognized security practices. This foundation lets Phoenix deliver scalable, reliable and highly available services while maintaining a consistent security posture across every layer, from network architecture to data encryption and operational access controls.

These measures are reviewed and updated as the Platform evolves. Phoenix will not materially reduce a measure it has committed to a Customer during the term of that Customer's agreement.

2. Cloud Infrastructure

Phoenix uses a broad set of AWS managed services to deliver consistent performance, resilience and availability:

• Amazon EC2 (Elastic Compute Cloud): scalable, on-demand compute capacity for application workloads.
• Application Load Balancers: distribute incoming traffic across multiple instances to maintain performance and availability.
• AWS Global Accelerator: improves availability and performance by routing traffic through the optimal AWS network path.
• AWS CloudWatch: continuous monitoring, logging and alerting across infrastructure and application layers.
• Secure AWS S3 buckets: durable, access-controlled object storage for application and backup data.
• AWS Identity and Access Management (IAM): controls access to AWS resources through individual identities and least-privilege policies, with multi-factor authentication required for administrative access.
• AWS Key Management Service (KMS): creates, stores and controls the encryption keys used to protect data at rest.
• AWS CloudTrail: records administrative and API activity across the AWS environment, providing an audit trail of changes to infrastructure and access.

These services operate across multiple AWS Availability Zones, providing redundancy and enabling failover with minimal disruption to service continuity.

3. Network-Level Security

Phoenix employs a multi-layered network security architecture designed to prevent unauthorized access and mitigate network-based threats:

• AWS Web Application Firewall (WAF): filters malicious web requests and mitigates common web exploits.
• AWS Shield Standard: automatic protection against common network and transport-layer Distributed Denial-of-Service (DDoS) attacks.
• Virtual Private Cloud (VPC): a logically isolated network environment dedicated to Phoenix infrastructure.
• Network access controls and security groups: restrict traffic to only the protocols and ports required for each service.
• Private subnets: sensitive resources, such as databases, are not directly exposed to the public internet.
• NAT Gateway: allows secure outbound communication from private resources while blocking unauthorized inbound access.

4. Data Encryption

Encryption in transit. All data transmitted between users and the Phoenix platform is encrypted using TLS 1.3 with 256-bit encryption.

Encryption at rest. All databases and backups are encrypted using the AES-256 industry-standard encryption algorithm, protecting stored data against unauthorized access.

5. Customer Data Separation

Each Customer's records are held in a separate, dedicated database, so one Customer's payroll and human-resources records are never commingled with another's. Where a document module is enabled, uploaded documents are held in cloud object storage with access scoped to the Customer and enforced at the application layer.

6. Identity and Access Management

Access to the Phoenix platform, for both Customers and internal personnel, is governed by structured identity and access controls:

• Role-based access control (RBAC): user permissions are scoped to job function, following the principle of least privilege.
• Authentication controls: strong password policies and account lockout thresholds apply to all accounts. Multi-factor authentication (MFA) is supported for Customer user accounts and required for administrative access to production systems and hosting infrastructure.
• Internal access reviews: administrative and production access is limited to authorized personnel and periodically reviewed.
• Session management: authenticated sessions are time-bound and invalidated on logout or inactivity.

7. Application Security

Security is built into the software development lifecycle to reduce risk before code reaches production:

• Secure development practices: code changes undergo peer review prior to release.
• Dependency and vulnerability management: third-party libraries and packages are monitored for known vulnerabilities, with patches applied on a risk-prioritized basis.
• Environment separation: development, staging and production environments are logically isolated to prevent unauthorized data exposure.
• Patch management: operating-system and infrastructure patches are applied on a regular, documented interval.

8. Backups and Business Continuity

Phoenix maintains a backup strategy aligned with the 3-2-1-1-0 model: multiple copies of data are kept across different storage media, with one copy stored offsite, one immutable or offline copy, and regular verification to confirm backups can be restored without error. Specifically:

• Differential backups are performed multiple times daily.
• Full backups are completed daily.
• Backups are stored in encrypted AWS storage and retained for a minimum of 90 days, with an immutable copy protected by S3 Object Lock so it cannot be altered or deleted during its retention period.
• Backup integrity is routinely verified to confirm data can be successfully restored when required.

Phoenix's infrastructure is also designed for resilience against regional disruption. Workloads run across multiple AWS Availability Zones to reduce the impact of localized infrastructure failure, and load balancing with redundant compute resources supports continuity of service during infrastructure events.

9. Security Standards

Phoenix has not obtained formal certification against an external security standard. Our security program is nonetheless designed with reference to the principles and control objectives of ISO/IEC 27001, including risk management, access control and information security governance, and the practices on this page are implemented accordingly.

10. Data Protection

Customer information is never sold, shared or traded. Access to data is restricted to authorized personnel on a least-privilege basis, and system access follows the authentication and session controls described in Section 6. Further detail on how Phoenix collects, uses and shares personal data is set out in our Privacy Policy.

Security incidents. Where Phoenix becomes aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of Customer data, Phoenix will notify the affected Customer without undue delay and in any event within 72 hours of becoming aware, describing what is known of the incident, the remedial action being taken and the expected timeline for resolution.

11. Physical Security

Phoenix does not operate its own data centres. The Platform is hosted on Amazon Web Services infrastructure, and physical and environmental security of that infrastructure, including facility access controls, power, cooling and fire suppression, is AWS's responsibility under the AWS Shared Responsibility Model. Details of AWS's physical and environmental controls are available at AWS Data Center Controls.

12. Payment Information

Phoenix does not process or store payment card data. Subscription fees are invoiced and settled by bank transfer.

13. Reporting a Vulnerability

If you believe you have discovered a security vulnerability in the Platform, please report it to security@phoenixsoftgy.com. Please include enough detail for us to reproduce the issue, and avoid accessing, modifying or deleting data that is not your own while investigating. Phoenix aims to acknowledge a report within 5 business days and will keep you updated as the issue is addressed.

14. Questions

For questions about these measures, including from a Customer's security or procurement team, contact:

• Phoenix Software Inc.
• 73 Hadfield Street, Stabroek
• Georgetown, Guyana
• Email: support@phoenixsoftgy.com