Data Security and Compliance

1. Overview

This page describes how Logicon LLC (“Logicon,” “we,” “us”) protects the information our clients, partners and website visitors trust us with. It applies to our internal systems and to the client engagements we deliver. Where a client contract, statement of work or data processing agreement sets specific requirements, those terms take precedence. For how we handle personal information collected through our website, see our Privacy Policy.

2. Data ownership and use

• Clients retain ownership of their data at all times.
• We access and process client data only as needed to deliver the agreed services.
• We do not use, sell or share client data for any other purpose without written consent.
• At the end of an engagement, client data is returned or securely deleted as the contract specifies.

3. Security governance

Our security practices are guided by recognized frameworks, including ISO/IEC 27001, SOC 2 and the NIST Cybersecurity Framework. Security policies are documented, reviewed at least annually and updated as our services, tools and risks change.

4. Access control

• Access is granted on a least-privilege, need-to-know basis and tied to named individuals.
• Multi-factor authentication is required on company systems and used with single sign-on where available.
• Access rights are reviewed regularly and removed promptly when a role changes or an engagement ends.
• Wherever possible, we work inside client-owned environments using client-issued accounts.

5. Encryption

Data is encrypted in transit using current TLS protocols and encrypted at rest using industry-standard algorithms. Credentials, keys and secrets are stored in managed vaults and are never written into source code.

6. Secure development

• All code changes are peer reviewed before release.
• Dependencies and code are scanned for known vulnerabilities.
• Development, test and production environments are kept separate.
• Production data is not used for testing unless the client approves it and it is masked or minimized.
• Applications are security tested, including penetration testing, before major releases.

7. Responsible use of AI

• We use enterprise AI services configured so client data is not retained or used to train models.
• Client data is never used to train public or third-party models.
• AI agents are tested, logged and monitored, and people stay in control of decisions that require judgment.

8. Monitoring and incident response

Systems are monitored for suspicious activity, with alerting for security events. We maintain a documented incident response plan that defines roles, escalation and communication. If a security incident affects client data, we notify the client without undue delay and within the timelines set by contract and applicable law.

9. Business continuity

Critical systems and data are backed up, and recovery procedures are documented so we can restore service and continue supporting clients after a disruption.

10. Vendors and subprocessors

Third-party providers are reviewed for security and privacy before we use them and are bound by written data protection terms. A current list of subprocessors that handle client data is available on request.

11. People and training

Everyone at Logicon signs confidentiality agreements and completes security and privacy training when they join and on an ongoing basis. Non-disclosure and data protection agreements are in place at the start of every client engagement.

12. Compliance

We support our clients’ obligations under applicable data protection and industry regulations, including GDPR, CCPA/CPRA and, where relevant, HIPAA. Data processing agreements, business associate agreements and responses to security questionnaires are available on request.

13. Reporting a security concern

If you believe you have found a security vulnerability or issue, please email hello@logicon.co with “Security” in the subject line. We will acknowledge your report promptly and will not take action against good-faith research.

14. Contact us

Questions about our security practices or your compliance requirements? Email hello@logicon.co and our team will walk you through them.