top of page

Information Security Policy

Effective Date: 13 July 2026

1. Purpose

Boundary Review is committed to protecting the confidentiality, integrity and availability of the information entrusted to us by our customers.

This Information Security Policy outlines the technical and organisational measures implemented to protect customer information and support compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The policy demonstrates our commitment to maintaining secure systems, protecting personal data and ensuring the resilience of the Boundary Review service.

 

2. Scope

This policy applies to:

  • Boundary Review.

  • All customer information processed by Boundary Review.

  • Customer support activities.

  • Systems used to deliver the Boundary Review service.

  • Third-party cloud services used by Boundary Review.

  • All devices authorised to access customer information.

 

3. Information Security Principles

Boundary Review is committed to:

  • Protecting information against unauthorised access.

  • Maintaining the confidentiality of customer data.

  • Preserving the integrity and accuracy of information.

  • Ensuring information remains available when required.

  • Continuously improving security practices.

  • Meeting applicable legal and regulatory requirements.

 

4. Cloud Infrastructure and Data Storage

Boundary Review currently delivers its service using secure Google Workspace services.

Customer information may be securely processed or stored using:

  • Google Drive

  • Google Sheets

  • Google Apps Script

  • Gmail (for customer communications where required)

Google Workspace provides enterprise-grade security controls, including encryption in transit and at rest, security monitoring and identity management.

Customer information is processed solely for the purpose of providing and supporting the Boundary Review service.

 

5. Access Control

Boundary Review follows the principle of least privilege, ensuring access to customer information is limited to authorised personnel who require it to deliver and support the service.

Security controls include:

  • Individual administrator accounts.

  • Strong password requirements.

  • Multi-factor authentication (MFA) for administrator accounts.

  • Role-based access controls.

  • Restricted administrative privileges.

  • Regular review of user permissions.

  • Immediate removal of access where it is no longer required.

  • Automatic screen locking on administrator devices after a period of inactivity to reduce the risk of unauthorised access.

 

6. Encryption and Device Security

Boundary Review relies on Google Workspace's enterprise-grade security features together with secure device management practices.

Security measures include:

  • Encryption of data in transit using HTTPS/TLS.

  • Encryption of data at rest within Google Workspace.

  • Secure authentication processes.

  • Administrator devices protected with strong passwords.

  • Full-disk encryption enabled on administrator devices where supported by the operating system.

  • Automatic installation of operating system and security updates where practical.

  • Built-in anti-malware and operating system security protections kept up to date.

  • Automatic screen locking after periods of inactivity.

  • Access to customer information only from trusted devices under the control of Boundary Review.

 

7. Backups and Data Recovery

Boundary Review maintains measures to support business continuity and data recovery.

These measures include:

  • Google Drive version history, enabling recovery of previous file versions where appropriate.

  • Automated monthly backups of customer spreadsheets using Google Apps Script.

  • Secure storage of backup copies within the Boundary Review Google Workspace environment.

  • Recovery procedures to restore customer information following accidental deletion or file corruption where reasonably practicable.

  • Periodic review of backup processes to help ensure they remain effective.

 

8. Monitoring and Audit Logging

Boundary Review maintains appropriate records of system activity to support security, troubleshooting and accountability.

Where applicable, audit information may include:

  • User account activity.

  • Login activity.

  • Review workflow activity.

  • Administrative actions.

  • Support activity.

These records help to:

  • Investigate incidents.

  • Support troubleshooting.

  • Maintain an audit trail.

  • Improve service security.

  • Identify unauthorised or unusual activity.

 

9. Data Retention

Customer information is retained only for as long as necessary to provide the service and to comply with contractual or legal obligations.

Upon termination of the service, customer information will be securely returned or deleted in accordance with the applicable agreement and Boundary Review's Data Retention Policy.

 

10. Security Incident Management

Boundary Review maintains procedures for identifying, investigating and responding to security incidents.

Where a confirmed personal data breach affects customer information, the affected customer will be notified without undue delay in accordance with UK GDPR requirements.

Incident reviews are undertaken to identify lessons learned and improve future security.

 

11. Business Continuity and Service Resilience

Boundary Review is committed to maintaining service continuity wherever reasonably practicable.

Measures supporting resilience include:

  • Secure cloud-based infrastructure.

  • Google Workspace enterprise security.

  • Google Drive version history.

  • Automated monthly backups.

  • Planned maintenance procedures.

  • Regular review of operational processes.

  • Recovery procedures for accidental deletion or corruption of customer information.

 

12. Third-Party Service Providers

Boundary Review uses carefully selected third-party providers to support the delivery of its services.

Current providers include:

  • Google Workspace (cloud infrastructure, email, storage and automation)

  • Wix (website hosting)

  • Google Analytics (website analytics)

Boundary Review seeks to ensure that these providers maintain appropriate security standards and data protection commitments.

 

13. Confidentiality

Boundary Review is committed to maintaining the confidentiality of customer information.

Customer information is accessed only where necessary to deliver or support the service and is never disclosed to unauthorised third parties.

Information is processed in accordance with the Boundary Review Privacy Policy and Data Processing Agreement.

 

14. Staff and Administrator Responsibilities

Anyone authorised to access customer information is responsible for:

  • Protecting customer information.

  • Maintaining the confidentiality of data.

  • Using secure authentication methods.

  • Following this Information Security Policy.

  • Reporting suspected security incidents promptly.

  • Keeping devices secure and updated.

 

15. Policy Review and Continuous Improvement

Information security is an ongoing process.

Boundary Review regularly reviews its technical and organisational measures to ensure they remain appropriate, effective and proportionate.

This policy will be reviewed periodically and updated where necessary to reflect changes in legislation, technology, operational practices or security risks.

 

16. Contact

For questions regarding this Information Security Policy or Boundary Review's information security practices, please contact:

Boundary Review

Email: info@boundaryreview.co.uk

bottom of page