Security Manifest

Introduction

Data and information are essential assets for WAAPITI SL, for its clients, for the end users of its services, for its partners and integrators, for its suppliers and for all other interested parties.

WAAPITI SL designs, develops, deploys, maintains and operates a SaaS multimedia content management platform for Digital Signage (Waapiti CMS), hosted on Amazon Web Services (AWS). In the context of this activity, the protection of information is indispensable to deliver its services in a secure, reliable manner and in accordance with the applicable legal, contractual and regulatory obligations.

Through its platform and its support channels, WAAPITI SL processes operational information belonging to clients, personal data of end users, corporate information and the source code of its product. For this reason, information security, privacy and the protection of personal data form part of its operating principles and its public commitment.

Commitment and basic principles

Through the definition of a normative framework, policies, procedures and controls of mandatory compliance, WAAPITI SL establishes its commitment to information security and to the continuous improvement of the technical, organizational and legal measures required to protect the information it processes and manages. This commitment is founded on the following basic principles:

  1. Protect the confidentiality, integrity and availability of the information of WAAPITI SL, of its clients, of the end users of its services, of its partners and of its suppliers.
  2. Systematically assess the risks that may affect information and apply proportionate measures for their control, mitigation and monitoring.
  3. Ensure that personal data is processed lawfully, fairly, transparently and limited to the purposes communicated or authorized, in accordance with the GDPR and the Spanish LOPDGDD.
  4. Apply technical and organizational measures aimed at preventing the alteration, loss, unauthorized access or improper processing of information, both in the CMS platform and in the cloud infrastructure and corporate environments.
  5. Require suppliers, data processors and partners to comply with obligations of confidentiality, security and limited use of information in accordance with the instructions of WAAPITI SL.
  6. Ensure the availability and continuity of the critical services delivered through the platform, including the capacity to respond to incidents, emergencies or contingencies.
  7. Act swiftly, diligently and responsibly in response to any incident that may compromise the security of data or information, including notification to interested parties and to the competent authorities where applicable.
  8. Promote the awareness, training and accountability of all individuals who access, process or manage information on behalf of WAAPITI SL.
  9. Comply with the applicable legal, normative, contractual and regulatory requirements, including those relating to privacy and the protection of personal data.
  10. Orient the Information Security Management System towards continuous improvement, taking the ISO/IEC 27001:2022 standard as its reference.

Roles and responsibilities

WAAPITI SL keeps the roles and responsibilities related to information security defined, documented, communicated and up to date, ensuring that its personnel — as well as collaborators, partners and suppliers where applicable — are aware of their obligations regarding the protection of information.

Oversight of the Information Security Management System rests with the ISMS Governance Council, the governing body of WAAPITI SL, which appoints an Information Security Management Leader as the person responsible for the ISMS.

The organization promotes an appropriate allocation of duties, accountability and the active involvement of the areas engaged in the protection of information assets.

Information Security Management System

WAAPITI SL has established, maintains and continuously improves an Information Security Management System (ISMS), taking as its reference the ISO/IEC 27001:2022 standard and recognized best practices in information security.

The scope of the ISMS covers the design, development, deployment, maintenance and support of the SaaS multimedia content management platform (CMS), hosted on Amazon Web Services (eu-west-1 region), including the technical support and incident management processes controlled by WAAPITI SL.

The ISMS is supported by a documentary framework, an organizational governance structure, clear responsibilities and controls proportionate to the context of WAAPITI SL. Together with the legislation in force, it constitutes the overall framework for protecting information, preserving the trust of interested parties and ensuring the continuity of services.