MyBix.App Security Policy

1. Purpose

This Security Policy describes the measures and practices used to protect the confidentiality, integrity and availability of information processed and stored through MyBix.App and its associated services.

The objective of this Policy is to protect customer information against unauthorised access, disclosure, alteration, loss and destruction while supporting compliance with applicable legal, regulatory and contractual requirements.

2. Scope

This Policy applies to the MyBix.App platform and associated services, the employees, contractors and authorised personnel with access to systems supporting MyBix.App, customer data processed through MyBix.App, and the supporting infrastructure, applications, databases, integrations and third-party services used to deliver the platform.

3. Security Principles

MyBix.App is operated according to the following security principles:

Least privilege access.

Defence in depth.

Secure by design.

Data minimisation.

Continuous monitoring and improvement.

Protection of customer confidentiality.

4. Account Security and Authentication

4.1 User Accounts

Each MyBix.App user should have an individual account. Shared accounts are not permitted.

Access permissions are assigned according to business requirements, user roles and job responsibilities.

4.2 Password Requirements

User passwords must meet the password requirements implemented by MyBix.App. Passwords should be sufficiently strong and not easily guessable.

Passwords are not stored in plain text.

Users must not disclose or share their passwords or authentication credentials with other individuals.

4.3 Multi-Factor Authentication

Multi-Factor Authentication (MFA) is supported by the Service where made available.

Users are encouraged to enable MFA to strengthen account security.

MFA may be required for certain administrative or privileged accounts where determined necessary by operational requirements.

4.4 Access Management

User access may be modified, suspended or revoked when access is no longer required.

Administrative and privileged access is restricted to authorised personnel.

Access permissions are reviewed periodically.

5. Data Protection

5.1 Customer Data

Customer data remains under the control of the customer. Where It’s All Savvy Ltd processes customer personal data on behalf of a customer, it acts as a processor in accordance with the applicable Data Processing Agreement.

It’s All Savvy Ltd may also process limited information as an independent controller where necessary for its own account administration, billing, support, security, legal, fraud prevention or business administration purposes, as described in the MyBix.App Privacy Notice.

5.2 Data Minimisation

Customers are encouraged to store and process only information necessary for legitimate business purposes and the functionality being used.

5.3 Data Retention

Information is retained only for as long as reasonably required to provide the Service, meet contractual or operational requirements, support security and administration, or comply with legal requirements.

Specific retention periods for particular services, including AI Receptionist data, are described in the applicable privacy and service documentation.

5.4 Secure Disposal

When information is no longer required, it is securely deleted or anonymised using appropriate methods. Backup copies may persist for a limited period where necessary for disaster recovery and business continuity.

6. Encryption

6.1 Data in Transit

Data transmitted between users and MyBix.App is protected using industry-standard encryption protocols such as Transport Layer Security (TLS).

6.2 Data at Rest

Where supported by the relevant hosting and infrastructure providers, stored data is protected using encryption technologies designed to help prevent unauthorised access.

7. Infrastructure Security

MyBix.App is hosted and operated using professionally managed cloud infrastructure and supporting technology services.

Security measures may include network firewalls, access controls, security monitoring, system hardening, vulnerability management, backup and recovery controls and restricted access to production systems.

Access to production systems is limited to authorised personnel with a legitimate business need.

8. Vulnerability Management

It’s All Savvy Ltd maintains processes intended to identify and address security vulnerabilities affecting systems supporting MyBix.App.

These processes may include security updates and patch management, vulnerability scanning, security testing and review of relevant security advisories.

Security vulnerabilities are prioritised for remediation based on their assessed risk and potential impact.

9. Monitoring and Logging

Security-related events are logged and monitored where appropriate.

Examples may include authentication activity, administrative actions, access-control changes and relevant system events.

Logs may be retained for operational, security, troubleshooting and compliance purposes.

10. Backup and Business Continuity

It’s All Savvy Ltd maintains backup and recovery procedures designed to support recovery from accidental loss, corruption, system failure or service disruption.

Backup processes may include automated backups, secure storage of backup data and periodic testing or review of recovery procedures.

Business continuity and recovery arrangements may vary according to the underlying infrastructure and third-party services used to deliver particular MyBix.App features.

11. Incident Management

It’s All Savvy Ltd maintains procedures for responding to security incidents affecting systems supporting MyBix.App.

Incident management may include detection and investigation, containment, remediation, recovery of affected services, documentation and post-incident review.

Where a security incident involves personal data processed on behalf of a customer and notification is required under the applicable Data Processing Agreement or law, the affected customer will be notified without undue delay and relevant information and reasonable assistance will be provided.

Where required by law or contractual obligations, reportable incidents will be notified within applicable timeframes.

12. Personnel Security

Personnel with access to customer data or production systems are expected to follow documented security procedures and maintain confidentiality obligations.

Personnel are expected to complete appropriate security awareness or role-specific training where required.

Suspected security incidents must be reported promptly through the appropriate internal process.

Access is granted based on role requirements and removed or adjusted when it is no longer required.

13. Third-Party Services

It’s All Savvy Ltd may use third-party service providers to support the delivery, operation and security of MyBix.App.

Third-party providers are selected with consideration given to security, reliability, privacy and compliance requirements.

Access granted to third parties is limited to what is reasonably necessary for the relevant service.

Relevant subprocessors and service providers are identified in the MyBix.App Privacy Notice or applicable Data Processing Agreement where required.

14. Payments and Connected Services

MyBix.App may integrate with third-party services, including payment, messaging, email, telephony, AI and other service providers.

Payment processing may be provided through Adyen as part of Savvy Pay. MyBix.App does not require customers to store payment card details directly within the application where those details are handled by the relevant payment provider.

SMS and communications functionality may use Twilio and Twilio SendGrid. AI Receptionist functionality may use ElevenLabs, OpenAI through ElevenLabs and Twilio.

Third-party services may have their own security, privacy and compliance controls and contractual terms. Relevant processing arrangements are described in the applicable privacy and data protection documentation.

15. Compliance and Privacy

It’s All Savvy Ltd is committed to complying with applicable data protection and privacy legislation, including EU GDPR and UK GDPR where applicable.

Appropriate technical and organisational measures are implemented to protect personal data processed through MyBix.App.

International transfers of personal data are managed using appropriate legal mechanisms and safeguards in accordance with applicable data protection requirements.

16. Customer Responsibilities

Customers are responsible for maintaining the confidentiality of account credentials and authentication information.

Customers are responsible for assigning appropriate user permissions and reviewing user access regularly.

Customers are responsible for ensuring that information entered into MyBix.App is lawful, appropriate and necessary for their intended business purposes.

Customers are encouraged to enable MFA where available.

Customers are responsible for maintaining appropriate security practices on devices, networks and systems used to access MyBix.App.

17. Security Reporting

Customers should report suspected security vulnerabilities, unauthorised access, security incidents or other security concerns relating to MyBix.App to It’s All Savvy Ltd as soon as reasonably possible.

Security reports should be sent to hello@itsallsavvy.com unless another security contact has been provided to the customer.

18. Policy Review

This Policy is reviewed periodically and may be updated to reflect changes in technology, business operations, legal or regulatory requirements, third-party services or security risks.

The latest version of this Policy will be made available through the MyBix.App website or upon request.

Policy Information

Policy Owner: It’s All Savvy Ltd (Ireland)

Effective Date: October 2026

Version: 1.0

Review Frequency: Annually