Information security policy #

Effective date: 2026-05-21 Last reviewed: 2026-09-23 Next review: 2027-05-21 Owner: Yaroslav Shmarov, operator Version: 1.1

1. Purpose #

This policy states the information-security objectives that govern EthicsPortal, the controls that satisfy them, and the responsibilities that maintain them. It exists so that customers, controllers under GDPR, regulators, and procurement reviewers can refer to a single named document for the security posture of the Service.

This policy is the parent document for the business continuity plan , the risk register , the internal audit record , the management review record , and the ISO/IEC 27001:2022 self-assessment .

2. Scope #

This policy applies to:

• The EthicsPortal Service — the reporter portal, handler portal, and supporting infrastructure listed on the Security page.
• All personal data processed by the Service on behalf of customer organizations (controllers under GDPR), including report content, reporter identity, handler messages, file attachments, and audit-log entries.
• The operator and all sub-processors listed on the subprocessors page.

This policy does not extend to systems operated by the controller (the customer organization) outside the Service.

3. Objectives #

EthicsPortal commits to three primary security objectives, in order of priority:

1. Confidentiality of reporter identity. Personal data identifying or reasonably capable of identifying a whistleblower is protected against unauthorized disclosure to any party — including controller-side personnel who are not designated handlers, sub-processors, and the operator’s own infrastructure providers — to the extent technically feasible.
2. Integrity of the audit trail. Records of who did what, when, are preserved in an append-only form that cannot be altered by any user, including organization administrators.
3. Availability of the whistleblowing channel. The reporter portal is available to whistleblowers under the SLA target so that the protected reporting right under EU Directive 2019/1937 is not silently degraded.

Confidentiality takes precedence over availability where the two conflict — the reporter portal will be taken offline in the event of a credible threat to reporter identity, with disclosure under the incident register .

Each objective carries a measure and a target, so that a management review can conclude whether it was met rather than only that work was done:

These targets are reviewed annually alongside this policy. A missed target is a nonconformity, recorded and corrected under the internal audit programme, not a number quietly restated.

4. Roles and responsibilities #

EthicsPortal is operated by a single named individual, Yaroslav Shmarov, who holds all of the following responsibilities:

The single-operator structure is documented openly on the Trust page. Continuity arrangements that compensate for this structure are stated in the business continuity plan .

5. Control commitments #

The technical and organizational measures implementing this policy are documented on the Security page and are summarized below. Each commitment maps to one or more ISO/IEC 27001:2022 Annex A controls in the control map .

6. Risk management, internal audit and management review #

Information-security risks are assessed against the Service annually and after any material change to architecture, sub-processors, or the threat landscape. The current assessment, treatment, and residual-position decisions are published in the risk register .

Risks accepted as residual are stated openly with a justification; risks not yet treated are stated openly with a target.

The management system is audited annually against ISO/IEC 27001:2022 and against the commitments published on this site. The programme, the audits performed, and every finding they raise are published in the internal audit record . Audit findings, monitoring results, and progress against the objectives in §3 are then reviewed by the operator as top management and recorded in the management review record .

Both are self-performed. A single-person organization cannot produce an impartial internal audit, and that limitation is stated on each page rather than worked around. It is the reason an independent external review remains the principal open item on the ISO/IEC 27001:2022 self-assessment .

7. Sub-processor management #

EthicsPortal engages sub-processors only where the function cannot reasonably be performed in-house and where the sub-processor materially improves availability, confidentiality, or compliance for the customer. The current list, the data each sub-processor receives, and the legal jurisdiction of each are published on the subprocessors page.

No large language model, generative-AI service, or AI-based classifier is engaged as a sub-processor. This is a documented product commitment (DPA §6.10 ) and a confidentiality-grade decision (Coverage map §5 ), not a configuration default.

Controllers are notified at least 30 days before any sub-processor is added or replaced. A controller that objects to a proposed change may terminate the agreement under DPA §6.4 without penalty.

8. Personnel security #

EthicsPortal has no employees or contractors. All personal data is processed exclusively by the named operator.

Having no employees removes a hiring process, not the operator. ISO/IEC 27001:2022 Clause 7.2 requires the competence of the people doing the work to be determined and recorded regardless of headcount, so screening (A.6.1) and awareness (A.6.3) are marked Compensating in the self-assessment rather than not applicable, and the compensating arrangements are these:

• Identity and accountability in place of screening. The contracting party, registry number, and tax registration are published on Trust and the registry extract is available during procurement review. A privileged-production-access summary is available on the same basis.
• Competence. The operator’s background is professional Ruby on Rails development, including public technical teaching on the framework. Security-relevant competence is maintained through the feeds listed at ISO 27001 A.5.6 — CVE feeds, the Rails security mailing list, and the Ruby Advisory Database — and is exercised and evidenced through the testing published at self-conducted security testing . This is a self-declaration; no third-party security certification is held or claimed.
• Continuity in place of succession. Arrangements are stated in the business continuity plan and the residual gap is carried openly as risk register R-01 .

A.6.4 (disciplinary process) and the remaining employment-lifecycle controls stay Not applicable: there is no employment relationship for them to govern.

If EthicsPortal engages additional personnel in the future, this policy will be updated to state the screening, training, and offboarding procedures that apply.

9. Physical security #

EthicsPortal does not operate its own physical infrastructure. Server, database, and object-storage hosting are provided by Hetzner Online GmbH in Nuremberg, Germany. Physical security controls (data-center access, environmental controls, media destruction) are inherited from Hetzner and documented in their published certifications. See subprocessors .

The operator does not maintain a physical office that processes customer data. Operator workstations used for production access are protected by full-disk encryption and screen-lock controls.

10. Compliance #

EthicsPortal commits to compliance with:

• GDPR (Regulation 2016/679), particularly Articles 5, 28, 32, and 33.
• EU Directive 2019/1937 on the protection of persons who report breaches of Union law.
• National transpositions of the Directive in the customer’s country of operation. See whistleblower laws by country .
• EU Accessibility Act / EN 301 549 for the reporter-facing portal. See accessibility and the EN 301 549 conformance statement .

EthicsPortal does not currently hold ISO/IEC 27001 certification. The platform publishes a structured self-assessment at /iso-27001/ covering both the mandatory Clause 4–10 requirements and all 93 Annex A controls, in the form of a Statement of Applicability. When accreditation is obtained, the certificate scope and date will be published on /trust/ .

11. Policy violations and enforcement #

A violation of this policy by the operator is a violation of the contractual commitments to controllers and may trigger:

• A reportable entry in the incident register
• Notification to affected controllers under DPA §6.6
• Notification to the competent supervisory authority where Art. 33 GDPR requires it

Where a violation is suspected or reported, the operator is required to record, investigate, remediate, and disclose under the same process as any other security incident.

12. Document control #

This policy is reviewed annually and after any of the interim triggers above. The effective date and version are incremented when the policy is materially revised.

Signed: Yaroslav Shmarov, on behalf of EthicsPortal — 2026-09-23.

Last updated: September 30, 2026