Sornik Information Security Policy

Sornik's security program is based on the following principles:

• confidentiality
• integrity
• availability
• least privilege
• data minimization
• separation of duties
• monitoring and logging of security events
• vulnerability management
• incident response

Sornik uses appropriate encryption methods for its service communications.

The purpose of these controls is to reduce the risk of eavesdropping, alteration, or unauthorized manipulation of information in transit.

Access to Sornik systems and data is managed according to the principle of least privilege.

Employee or technical component access should be limited as much as possible to resources necessary for their duties.

Sornik uses appropriate security controls to protect accounts and user sessions.

Users are also responsible for protecting:

the following.

• passwords;
• authentication codes;
• access keys;
• active sessions;
• and other confidential account information

Sornik strives to protect sensitive information using appropriate controls during transmission and, where necessary, during storage.

Sensitive data should be accessible only to systems and persons authorized to access it.

Sornik may log and monitor technical and security events for purposes such as:

Sornik may log and monitor such events.

This logging should be proportionate to the security purpose and operational need.

• detecting attacks;
• identifying abuse;
• investigating errors;
• maintaining account security;
• analyzing security incidents

Sornik may use backup and recovery mechanisms to reduce the risk of information loss.

Backups must be maintained under appropriate security controls.

Sornik strives to identify, prioritize, and remediate known security vulnerabilities in a timely manner.

Severity, likelihood of exploitation, and potential impact of each vulnerability are considered when determining remediation priority.

Sornik invites security researchers and responsible users to report genuine security vulnerabilities responsibly.

A report should include sufficient information to reproduce and investigate the issue.

Reporters must not:

After receiving a report, Sornik will review it and, if confirmed, take appropriate corrective action.

• view or extract user data;
• disclose personal information;
• disrupt the service;
• modify data;
• use a vulnerability to obtain unauthorized benefit.

When a security incident is identified, Sornik strives to:

1. identify and contain the incident;
2. assess the scope of impact;
3. analyze the cause and path of the incident;
4. take corrective action;
5. apply additional preventive measures when necessary;
6. provide required notice where law or circumstances require it.

Upon receiving a valid request from a legally authorized authority, Sornik will cooperate within the bounds of applicable laws.

Where permitted by law, Sornik will strive to review information-related requests for validity, scope, and necessity.

Security is not limited to Sornik infrastructure alone.

Users should also:

• use a strong password;
• not share their login credentials with others;
• not disclose authentication codes;
• keep their software and devices up to date;
• not use suspicious links or files;
• not enter private keys or confidential information into services not designed to receive them.

Sornik strives to review valid security reports with a responsible and technical approach.

Security requests must be submitted through the official channel announced by Sornik.

Despite implementing security controls, no internet-connected system can be absolutely immune to all threats.

Sornik is committed to ongoing efforts to reduce security risks, but cannot guarantee that all security incidents will be prevented.

To avoid increasing security risk, Sornik does not publicly publish sensitive details related to:

in this public document.

• internal network architecture;
• internal security configurations;
• administrative paths;
• access credentials;
• sensitive infrastructure addresses;
• internal detection and response methods;
• equipment configuration;
• or other information whose disclosure could reduce system security

Sornik may update this policy in line with technical, security, and legal changes.

The new version will be published at this address.

Security reports must be submitted through the official channel announced by Sornik.

Please do not publish sensitive user information or confidential data in public reports.