Trust Center
Policies
The policies below form our information security management program. They are reviewed at least annually and approved by management. Each is downloadable as a PDF.
Download all policies (ZIP)Governance
Information Security Policy
The master policy that establishes our commitment to protecting information and governs all other security policies.
Risk Management Policy
How we identify, assess, treat, and monitor information security risks.
Acceptable Use Policy
The rules for responsible use of company and client systems, data, and devices.
AI Usage Policy
How we use AI responsibly across Backpack OS and internally so customer and client data stays protected.
Access & Identity
Data
Data Classification & Handling Policy
How we classify data by sensitivity and the handling rules for each level.
Data Retention & Disposal Policy
How long we keep data and how we securely return or destroy it.
Encryption & Key Management Policy
Standards for encrypting data in transit and at rest and managing keys and secrets.
Operations
Incident Response Plan
Roles, severity levels, and the steps we follow to detect, contain, and recover from security incidents.
Business Continuity & Disaster Recovery Plan
How we maintain and restore service and client work during a disruption.
Change Management Policy
How changes to code and production systems are reviewed, approved, and deployed.
Logging & Monitoring Policy
What we log, how we monitor for security events, and how long logs are retained.
Backup Policy
What we back up, how it is protected, and how restores are tested.