#Information Security Policy

POL-GL-100 | Version 1.0.0 | Last Modified On 31 July 2026 | Tier: Public

This is the apex information security policy of Edsol Edtech Pvt. Ltd.. Every other policy in the POL-GL-1xx series is subordinate to it. It is approved by the Founder and it is published in full.

---

#Applicability

---

#1. Purpose

This policy states how Edsol Edtech Pvt. Ltd. protects the information entrusted to it: above all, the patient, clinical, financial and operational data of the hospitals that run on Pensieve. It defines the security objectives, the governance that maintains them, the obligations that bind every person working for or with Edsol Edtech Pvt. Ltd., and the consequences of not meeting them.

It is published rather than held internally for one reason: Edsol Edtech Pvt. Ltd. holds no security certifications, so a hospital cannot rely on an auditor's opinion. It is given the policy instead, and is invited to test it.

---

#2. Scope

2.1 People. Every employee, founder, director, contractor, intern and temporary worker of Edsol Edtech Pvt. Ltd., and every third party granted access to Edsol Edtech Pvt. Ltd. systems or to customer data. Referred to throughout as Personnel.

2.2 Information. All information Edsol Edtech Pvt. Ltd. creates, receives, stores or processes, classified under POL-GL-109, including: hospital patient and clinical data; hospital financial and operational data; hospital-supplied credentials for third-party systems; Edsol Edtech Pvt. Ltd.'s own source code, infrastructure configuration, contracts and commercial records; and Personnel data.

2.3 Systems. The Pensieve Platform in every deployment model; the build and deployment pipeline; the source repositories; the cloud projects; the secret stores; the Trust Center at https://trust.pensievelabs.org; corporate identity, email and collaboration systems; and every endpoint device from which Personnel access any of the above.

2.4 Out of scope. Infrastructure owned and operated by the hospital in DM-3 and DM-4; the hospital's own network, endpoints, identity provider and physical premises; and third-party systems the hospital connects to using its own credentials under the integration boundary in DIS-GL-024. Where a control depends on something outside this scope, the relevant policy says so rather than implying coverage.

---

#3. Security objectives

Edsol Edtech Pvt. Ltd. sets five objectives. Each is measurable, and each is measured at the management review under Section 9.

---

#4. Policy statements

Each statement below is written to be tested. Where a statement describes something that is not yet operating, it is marked [TARGET] with the owner and date, and it is not to be read as a description of current practice.

#4.1 Governance

4.1.1 Edsol Edtech Pvt. Ltd. maintains a documented information security policy set. The register of policies, their owners and their review dates is POL-GL-000 Section 2, and it is published.

4.1.2 The Founder (R_FOUNDER) is accountable for information security and approves this policy. Every subordinate policy has a named owner role recorded in POL-GL-000 Section 2.

4.1.3 A management review of information security is held quarterly. It covers: the Risk Register (REG-GL-202), open exceptions (REG-GL-210), incidents since the last review (REG-GL-203), the five objectives in Section 3 against their measures, overdue policy reviews, and progress against the targets in POL-GL-000 Section 6.2. The review is minuted with decisions, owners and dates.

4.1.4 Security risk is assessed and recorded under POL-GL-117. No risk is accepted without a named accepting role and a review date.

4.1.5 Personnel are bound by this policy from their first day. Acknowledgement is recorded before access to any system holding hospital data is granted, and is re-acknowledged annually (POL-GL-102, REG-GL-209).

#4.2 Access to hospital data

4.2.1 Access to hospital data follows default deny. A permission not explicitly granted is denied.

4.2.2 No Personnel hold standing access to production data. Access is requested per intervention with a stated tenant, reason, scope and duration; approved by a second person; granted as a time-bound, least-privilege role that expires automatically; and logged (POL-GL-134).

4.2.3 Self-approval of a production access grant is not possible. Where the request and approval roles would collide on the same person, POL-GL-127 Section 4.3 governs.

4.2.4 Every action taken under a production access grant is written to cloud audit logs that Pensieve Labs engineers cannot alter or delete (POL-GL-113).

4.2.5 Access grants, their reasons and their approvers are retained and are disclosable to the affected hospital on request within 5 business days.

4.2.6 Production data is never copied to a Personnel endpoint, a personal account, a local database, a spreadsheet, a screenshot, or any generative AI service. This is an absolute prohibition (POL-GL-102, POL-GL-132).

4.2.7 Access rights for all Personnel are reviewed quarterly by R_SEC and recorded in the Access Review Register (REG-GL-208). Privileged rights are reviewed in the same cycle by R_FOUNDER.

4.2.8 Access is revoked on a leaver's last working day, as a checklist item with a named owner and a recorded completion time (RBK-GL-021).

#4.3 Protection of information

4.3.1 All hospital data is encrypted at rest and in transit using the algorithms and key hierarchy in POL-GL-108 and POL-GL-129. Transport below TLS 1.2 is not accepted for any external connection.

4.3.2 Hospital-supplied credentials for third-party systems are write-only from the hospital's perspective: once supplied they are not rendered to any screen, log, export or support view (DIS-GL-025, POL-GL-129).

4.3.3 Credentials, secrets, session tokens and passwords are never written to any log. Redaction is applied at the logging boundary (POL-GL-113).

4.3.4 Information is classified and handled under POL-GL-109. Retention and disposal follow POL-GL-111.

4.3.5 Edsol Edtech Pvt. Ltd. does not use hospital data for its own purposes, does not use it to train models offered to other hospitals, and does not disclose it to any party other than the sub-processors published in DIS-GL-009 or where compelled by law, in which case, unless legally prohibited, the hospital is notified first (DPA-GL-001, POL-GL-067).

#4.4 Building and changing the Platform

4.4.1 Every change to production code arrives by pull request against a protected branch, is reviewed by a second person, and passes static analysis, dependency scanning, secret scanning and automated tests before merge (POL-GL-118, POL-GL-133).

4.4.2 No change reaches production without a change record naming the change, the approver, the rollout plan and the rollback trigger (POL-GL-107, REG-GL-205).

4.4.3 Staging and development environments never hold production data. Where test data must resemble production, it is synthetic or de-identified (POL-GL-118).

4.4.4 Cloud infrastructure is defined in code and reviewed as code. A change made directly in a console is an exception, is recorded, and is reconciled back into code (POL-GL-130, POL-GL-131).

4.4.5 A detected credential in source control is treated as compromised and rotated, not merely removed from the diff (POL-GL-133).

#4.5 Operating the Platform

4.5.1 Backups are taken, encrypted, held in the deployment's data region, and stored so that the application's own service identity cannot delete them (POL-GL-104).

4.5.2 A restore is tested quarterly and the measured RTO and RPO are published against the commitment (POL-GL-106). [TARGET]: the first published drill is owned by Roadmap bcdr drill owner with a target of Roadmap bcdr drill target.

4.5.3 Logs are retained for a minimum of 365 days, immutably, and for Indian deployments within Indian jurisdiction (POL-GL-113).

4.5.4 Production is monitored continuously for availability, error rate, latency, saturation, backup success, certificate expiry and integration failure, with alerts routed to an on-call engineer. Edsol Edtech Pvt. Ltd. does not operate a 24×7 staffed security operations centre and does not describe its alerting as one (POL-GL-113 Section 7).

4.5.5 Vulnerabilities are remediated or mitigated within the windows in POL-GL-121: Critical 72 hours, High 14 days, Medium 60 days, Low next scheduled release.

#4.6 Incidents

4.6.1 Every Personnel member must report a suspected security event immediately on becoming aware of it, through the channel in POL-GL-112. Delay in reporting is itself a policy breach.

4.6.2 An affected hospital is notified within 4 hours of Edsol Edtech Pvt. Ltd. becoming aware of a security incident affecting its data. The clock starts at awareness, not at triage. This is a contractual commitment in DPA-GL-001, not a statement of intent.

4.6.3 Notification content is sufficient for the hospital to make its own regulatory report without a second round trip (POL-GL-112 Section 5).

4.6.4 Every Sev-1 and Sev-2 incident produces a written post-incident review with root cause, timeline, contributing factors and remediation actions with named owners and dates. Affected hospitals receive it.

4.6.5 An incident-response exercise is run and summarised publicly on a scheduled cadence. [TARGET]: first exercise owned by Roadmap tabletop owner, target Roadmap tabletop target.

#4.7 Third parties

4.7.1 No third party processes hospital data unless it is assessed under POL-GL-120, contracted with the required security and data-protection terms, and published in the Subprocessor Register (DIS-GL-009).

4.7.2 Hospitals are notified of a new or replaced sub-processor before it begins processing, with the objection right in DPA-GL-001 (POL-GL-135).

4.7.3 Edsol Edtech Pvt. Ltd. does not claim its cloud provider's certifications as its own. The exact permitted statement is in WPR-GL-001 Section 16.4 and it is binding on every person who writes or speaks for Pensieve Labs.

#4.8 Truthfulness of security claims

4.8.1 No person representing Edsol Edtech Pvt. Ltd. may state, in a document, a questionnaire, a tender response, an email or a meeting, that Edsol Edtech Pvt. Ltd. holds a certification, attestation, empanelment or audit that it does not hold.

4.8.2 Security questionnaire answers are drawn from the published artefacts. Where no published artefact supports an answer, the answer is "not implemented" or "not held", with the target date if one exists.

4.8.3 A discovered overstatement in a published Pensieve Labs artefact is corrected within 5 business days, and any hospital that received the incorrect version is told.

4.8.4 Breach of Section 4.8 is treated as gross misconduct. This is the one area where the consequence is stated in the policy rather than left to the disciplinary process, because for a vendor with no certifications, credibility is the whole asset.

---

#5. Roles and responsibilities

Role codes are defined in POL-GL-000 Section 3. At Edsol Edtech Pvt. Ltd.'s current size, one person may hold several roles; the permitted and prohibited combinations are in POL-GL-127.

---

#6. Exceptions

Exceptions to this policy and to every subordinate policy follow the single process in POL-GL-000 Section 5. Three constraints apply without exception of their own:

1. Every exception has an expiry date; the maximum initial term is 90 days.
2. An exception that would contradict a contractual commitment to a hospital is refused; the contract is amended instead.
3. Every exception is recorded in REG-GL-210 and reported at the quarterly management review.

No exception may be granted to Section 4.6.2 (the four-hour notification) or to Section 4.8 (truthfulness of security claims).

---

#7. Compliance and enforcement

7.1 Monitoring. Compliance is evidenced by the registers listed in POL-GL-000 Section 2, not by assertion. A policy statement with no corresponding register entry is treated as unevidenced at the management review.

7.2 Self-assessment. R_SEC performs a documented self-assessment of this policy set annually, recording for each numbered statement: operating, partially operating, or not operating, with evidence. The result feeds the Risk Register and the targets in POL-GL-000 Section 6.2.

7.3 Independent review. [TARGET]: Edsol Edtech Pvt. Ltd. does not yet operate an independent internal audit function. Establishing one is owned by Roadmap internal audit owner with a target of Roadmap internal audit target. Until then, the independent element is limited to external penetration testing and VAPT under POL-GL-121, and to customer audits under ADD-GL-001.

7.4 Customer audit. A hospital's audit rights, including the right to inspect evidence of these controls, are in ADD-GL-001 and DPA-GL-001. Edsol Edtech Pvt. Ltd. does not restrict a hospital to a questionnaire.

7.5 Personnel breach. A breach of this policy by Personnel is handled under the disciplinary process in POL-GL-102, up to and including termination of employment or engagement and referral to law enforcement. Breach of Section 4.2.6 (copying production data) or Section 4.8 (truthfulness) is treated as gross misconduct.

7.6 Contractor and third-party breach. A breach by a contractor or third party results in immediate suspension of access, an incident record, and review of the engagement under POL-GL-120.

7.7 Certification programme. Edsol Edtech Pvt. Ltd. holds no certifications. The programme of independent assurance, with owners and target dates, is POL-GL-000 Section 6.2, and its live status is WPR-GL-005. Targets are published so they can be missed in public; a missed target is re-dated with a reason, not deleted.

---

#8. Related documents

---

#9. Review cadence

A version past its review_due_on is flagged internally and, after 30 days overdue, its true age is shown on the public document page.

---

#10. Change history