DRAFT — pending legal counsel review. This is a working draft prepared by the CelebIsland team. It has not been reviewed by qualified legal counsel, is not final, and may change. Items marked [COUNSEL TO CONFIRM] are open questions for counsel.
1. Scope
CelebIsland operates a Security Operations Centre (SOC) that protects the platform and may also offer security services — monitoring, incident response, vulnerability management, threat intelligence, and security training (Security Academy, cyber ranges) — to organisations ("Clients"). This policy sets the baseline terms for those services; each Client engagement is governed by a separate written agreement that prevails over this policy.
2. Service engagement
- Services begin only after a signed engagement or order form that defines scope, systems in scope, service levels, fees and points of contact.
- Clients must have authority over every system they ask us to monitor or test.
3. Client data
- We process Client data only to deliver the agreed services and on the Client's documented instructions.
- Data is logically separated per Client (tenant isolation) and access is limited to personnel with a need to know, under role-based access control with an audit log.
- [COUNSEL TO CONFIRM: data processing agreement template, cross-border transfer terms, and NDPA 2023 processor obligations.]
4. Confidentiality
Both parties keep each other's confidential information confidential. Security findings, vulnerabilities, and incident details are confidential to the Client.
5. Incident notification
We notify the Client of confirmed security incidents affecting their environment without undue delay and within the timeframe in the engagement agreement. [COUNSEL TO CONFIRM: default notification window and regulatory notification responsibilities.]
6. Evidence and retention
Evidence, logs and reports are retained for the period agreed in the engagement, protected with integrity controls, and returned or deleted at the end of the engagement unless the law requires otherwise.
7. Limitations
- Security services reduce risk but cannot guarantee that no breach will occur.
- [COUNSEL TO CONFIRM: limitation of liability and insurance requirements.]
8. Personnel
SOC analysts and AI-assisted tooling operate under the access controls described above. Human approval is required for high-impact actions such as account lockouts or containment on Client systems, as defined in the engagement.
9. Testing activities
Any active testing of Client systems is governed by the Penetration-Testing Authorization Policy.
