Security is a design requirement at Fenixoft.ai, not an afterthought. This policy describes the principles, controls and commitments that govern how we protect information across our AI services, our infrastructure and this website (https://fenixoft.ai).
Last updated: August 27, 2026Version 1.0
Applies to: fenixoft.ai, its services (Advisory, Start AI, AgroTech Labs) and its products (BloomWise, AgentX).
1. Purpose and Scope
This policy establishes the framework Fenixoft.ai uses to preserve the confidentiality, integrity and availability of the information we handle, whether it belongs to our clients, our partners, our team or the visitors of this website.
It applies to all employees, contractors and collaborators of Fenixoft.ai, and to any third party that processes information on our behalf.
It covers our corporate systems, our development and cloud environments, the artificial intelligence and data solutions we build, and the fenixoft.ai website and its content management system.
It covers information in every state: in transit, at rest and in use, in digital or physical form.
Specific projects may be subject to additional contractual security requirements agreed with the client; where those are stricter, they prevail over this policy.
2. Security Principles
Every decision we make about architecture, tooling and process is measured against the following principles.
Confidentiality: information is only accessible to those who are explicitly authorized to use it.
Integrity: information and the models derived from it must remain accurate, complete and traceable.
Availability: services and data must be accessible to authorized users when the business needs them.
Least privilege: every person, service and credential receives the minimum access required to do its job, and only for as long as it is needed.
Defense in depth: we combine network, application, identity and monitoring controls so that no single failure compromises the whole system.
Security and privacy by design: security requirements are defined during discovery and architecture, not added after delivery.
Transparency: we communicate clearly and promptly with our clients about risks, changes and incidents that affect them.
3. Governance and Responsibilities
Security is a shared responsibility with clearly assigned ownership.
The Technology Director owns this policy, its periodic review and the approval of exceptions, with executive sponsorship from the CEO.
Project leads are responsible for applying the policy in each engagement and for documenting any client-specific security requirement.
Every member of the team is responsible for protecting the information they access and for reporting any suspicious activity without delay.
Exceptions to this policy must be requested in writing, justified by a business need, time-bound and accompanied by compensating controls.
Non-compliance may result in the withdrawal of access, disciplinary action or termination of the contractual relationship.
4. Data Classification and Handling
We classify information so that the level of protection matches its sensitivity, and we treat client data as the property of the client at all times.
Public: content published deliberately, such as this website, our blog and our marketing materials.
Internal: operational documentation, non-sensitive project artifacts and internal communications.
Restricted: personal data, financial data and any information subject to specific regulatory duties.
Client data is processed only for the purposes agreed in the corresponding contract or statement of work, and is never sold or shared for advertising purposes.
We apply data minimization: we request only the data strictly required for the project, and we prefer anonymized, pseudonymized or synthetic datasets whenever they are technically viable.
At the end of an engagement, client data is returned or securely deleted according to the retention terms agreed with the client.
5. Access Control and Identity
Access to systems and data is granted on a need-to-know basis and reviewed regularly.
Named individual accounts for every user; shared accounts are not permitted.
Multi-factor authentication is mandatory on cloud consoles, code repositories, email and administrative panels.
Role-based access control with segregation of duties between development, review and production deployment.
Credentials, API keys and tokens are stored in secret managers or protected environment variables, never in source code or in the repository history.
Access is revoked immediately when a person leaves the organization or changes role, and permissions are reviewed periodically.
Administrative and privileged operations are logged and traceable to an individual.
6. Encryption and Communications
Information is protected in transit and at rest using industry-standard cryptography.
All traffic to and from fenixoft.ai is served over HTTPS with TLS 1.2 or higher and valid certificates.
Data at rest in our cloud environments is encrypted using AES-256 or the equivalent mechanism offered by the managed service.
Backups and exports containing confidential information are encrypted before storage or transfer.
We do not accept credentials, keys or sensitive data through unprotected channels such as public chat, plain email or the website contact form.
Deprecated protocols, weak cipher suites and self-signed certificates are not used in production.
7. Cloud and Infrastructure Security
Our website and services run on managed cloud infrastructure, primarily Amazon Web Services, configured according to the provider's security best practices.
Separation between development, staging and production environments, with independent credentials for each one.
Infrastructure defined and versioned as code where possible, so that changes are reviewable and reproducible.
Network exposure reduced to the minimum: only the ports and services strictly required are published to the internet.
Managed services are kept up to date with the security patches released by the provider.
Logging and monitoring of relevant events, with alerting on anomalous behavior and on failed authentication attempts.
Administrative interfaces, including the content management system, are protected by strong authentication and restricted access.
8. Secure Development Lifecycle
The software we build for our clients and for ourselves follows secure development practices from the first commit.
Version control with mandatory peer review before merging changes into main branches.
Server-side validation and sanitization of all user input, and encoding of output to prevent injection attacks.
Dependency management with periodic review of known vulnerabilities and timely upgrades of affected packages.
No secrets, real client data or production dumps in repositories, tickets or development environments.
Automated builds and controlled deployments, with the ability to roll back to a previous known-good version.
Security testing appropriate to the risk of the application, including review of authentication, authorization and data exposure paths.
9. Responsible and Secure Artificial Intelligence
As an AI company, we assume specific responsibilities regarding the data, models and agents we build.
Client data is never used to train models for other clients, nor to train public models, without explicit written authorization.
We select AI providers and models based on their data handling commitments, and we prefer options that exclude our inputs from provider-side training.
AI systems we deliver include controls against prompt injection, unauthorized tool use and leakage of context or system instructions.
Retrieval and agent architectures respect the permissions of the end user: a user must never obtain, through the model, information they could not access directly.
We document the intended purpose, the known limitations and the human oversight points of every AI solution we deliver.
We evaluate our models for bias, accuracy and robustness before delivery, and we recommend continuous monitoring after go-live.
10. Third Parties and Subprocessors
We rely on a reduced set of specialized providers, and we hold them to the standards we apply to ourselves.
We evaluate the security posture, certifications and data location of every provider before adopting it.
We use cloud hosting, email delivery and content management services to operate this website and our internal platforms.
Providers with access to confidential information are bound by confidentiality and data protection agreements.
We keep the list of providers to the minimum necessary and review it periodically.
Clients may request the list of subprocessors involved in their project at any time.
11. Security of This Website
This section describes specifically how fenixoft.ai handles the information of its visitors.
The site is served exclusively over HTTPS and its public content is generated statically, which reduces the attack surface.
The contact form collects only your name, your email address and the message you write. That information is used solely to answer your enquiry and is delivered to our corporate mailbox through a managed email service.
Please do not include passwords, financial details or sensitive personal data in the contact form.
We do not use advertising cookies or third-party tracking cookies. The browser storage we use is strictly technical: your theme preference (light or dark) and your scroll position, both stored in your own browser and never sent to our servers.
Editorial content is managed through a headless CMS whose administration panel is not publicly accessible and is protected by authenticated access.
Links to third-party sites, such as our social profiles, are governed by the privacy and security policies of those third parties.
12. Continuity, Backups and Resilience
We plan for failure so that an incident does not become a loss.
Periodic backups of critical systems and content, with encryption and controlled access.
Verification that backups can actually be restored, not merely that they were created.
Redundancy and automatic recovery capabilities provided by the managed cloud services we use.
Recovery objectives defined per project according to the criticality agreed with the client.
Documentation of dependencies and configurations required to rebuild a service from scratch.
13. Incident Response
We maintain a defined process to detect, contain and learn from security incidents.
Detection and triage: any suspected incident is reported internally without delay and assessed for severity and scope.
Containment and eradication: we isolate the affected assets, revoke compromised credentials and remove the root cause.
Recovery: we restore service from verified clean sources and confirm normal operation.
Notification: affected clients are informed as soon as we have confirmed material facts, and in any case within the timeframes required by the applicable contract or regulation. Where personal data is involved, we support the notification duties that apply, including the 72-hour window under the GDPR.
Post-incident review: every significant incident is documented with its root cause, its impact and the corrective actions adopted.
14. Responsible Vulnerability Disclosure
We welcome reports from the security community and we treat them as a contribution, not as a threat.
Report any vulnerability you find in fenixoft.ai or in our products to contact@fenixoft.ai, with enough detail to reproduce it.
We will acknowledge your report and keep you informed about the remediation status.
Please do not access, modify or delete data that does not belong to you, do not degrade the availability of the service, and give us reasonable time to remediate before any public disclosure.
Testing that is limited to your own accounts and data, and that follows these guidelines, will not be met with legal action from our side.
Denial-of-service testing, social engineering against our team and physical attacks are out of scope.
15. People and Awareness
Most incidents start with a person, and so does most prevention.
Confidentiality obligations are part of every employment and collaboration agreement.
The team receives guidance on phishing, credential handling, secure use of AI tools and safe management of client data.
Devices used for work must have disk encryption, screen lock, updated operating systems and endpoint protection.
Company information is handled only on authorized devices and services.
Reporting a mistake early is always preferable to hiding it; we treat honest reporting as expected behavior.
16. Legal and Regulatory Compliance
Our controls are aligned with internationally recognized frameworks and with the obligations of our clients.
Our practices take as a reference the ISO/IEC 27001 control families and the NIST Cybersecurity Framework, adapted to the size and risk profile of our organization.
We process personal data in accordance with the applicable data protection legislation, including the GDPR where relevant, on the basis of the principles of lawfulness, minimization, purpose limitation and storage limitation.
We support our clients in meeting their own compliance duties, including audit requests and security questionnaires related to the projects we deliver for them.
Where a client is subject to sector-specific regulation, the additional requirements are incorporated into the project as explicit controls.
17. Review and Updates
This policy is a living document.
It is reviewed at least once a year, and additionally after any significant incident or relevant change in our technology or services.
The current version is always the one published on this page, together with its last update date.
Substantial changes that affect our clients are communicated through the usual project channels.
Questions about our security?
If you need additional detail about these controls, want to report a vulnerability or need to complete a security questionnaire for your organization, we will be glad to help.