Zero Trust Policy

At Proof of life, we are committed to ensuring the highest level of security for our users. Our Zero Trust policy is designed to protect your data and our infrastructure by adhering to the following core principles: 

We always authenticate and authorize every request based on all available data points, including user identity, location, device health, and more. This ensures that only legitimate users and devices can access our resources. 

We limit user access with Just-In-Time (JIT) and Just-Enough-Access (JEA) principles. This means users only have the minimum level of access necessary to perform their tasks, reducing the risk of unauthorized access.

We recognize that insider threats can pose significant risks. To address this, we implement strict monitoring and auditing of user activities, enforce role-based access controls, and conduct regular security training for all employees. By fostering a culture of security awareness, we aim to reduce the likelihood of insider threats. 

We operate under the assumption that a breach could occur at any time. By minimizing the blast radius and segmenting access, we ensure that any potential breach is contained and mitigated quickly. We also use end-to-end encryption and advanced analytics to detect and respond to threats in real-time. 

As our site is hosted on Azure, we leverage Azure’s robust security features to implement our Zero Trust policy effectively. This includes:

• Conditional Access: Policies that require multi-factor authentication and assess user risk, device status, and other criteria before granting access
• Threat Protection: Continuous monitoring and automated threat detection to identify and remediate potential security issues2.
• Compliance: Our Zero Trust approach aligns with industry standards and regulations, including GDPR, ensuring that your data is handled with the utmost care and security3.

By adopting a Zero Trust model, we aim to provide a secure and trustworthy environment for our users. If you have any questions or concerns about our security practices, please don’t hesitate to contact us.