Information Security Policy

SmartLex’s activities span legal, scientific and computer science research, the development of software products and artificial intelligence services, and strategic consulting for public and private organisations. The security of information - including client data, research results shared with European partners, internally developed know-how and information entrusted by public and private bodies, as well as information concerning its own staff - is an essential condition for the organisation’s reliability and credibility towards all interested parties.

To this end, SmartLex is committed to:

• protecting the confidentiality, integrity and availability of information processed in the course of its research, product development and consulting activities, regardless of the format or medium in which it is stored or transmitted;
• assessing any critical issues relating to the information it manages in order to support the implementation of adequate levels of protection;
• establishing and periodically reviewing information security objectives, ensuring that they are measurable, monitored and consistent with the results of the risk assessment;
• meeting the applicable information security requirements, including regulatory requirements (such as the GDPR and the related national implementing legislation), contractual obligations towards clients and public bodies, and the obligations set out in the grant agreements of European research projects;
• adopting secure development practices for its software products, including controlled source code management, vulnerability management and the separation of development, test and production environments;
• ensuring that anomalies and incidents affecting the information system and the company’s security levels are promptly identified and properly managed through effective prevention, communication and response systems, in order to minimise the impact on the business;
• ensuring business continuity and disaster recovery through the application of established security procedures;
• securely managing relationships with cloud/hosting providers and other third-party suppliers, requiring adequate security requirements and verifying compliance with them over time;
• protecting know-how, prototypes and unpublished research results, particularly those shared with partners in European projects;
• raising awareness among and training staff, collaborators and external consultants on their information security responsibilities;
• continually improving the suitability, adequacy and effectiveness of the Information Security Management System;
• ensuring that access to the company’s physical premises is restricted to authorised personnel only, to safeguard the security of the areas and assets located there.