Information Security Policy

1 Purpose & Scope

This policy defines the information security controls in place for all systems operated by OurGrid, trading as OurNurseryGrid, OurFamilyGrid, OurKitchenGrid, OurHealthGrid, OurTeamGrid, OurEventsGrid, OurTicketGrid, OurFinanceGrid and OurProjectGrid.

This policy is aligned with the NCSC Cyber Essentials framework (Montpellier v3.1) and UK GDPR requirements for processing children's personal data.

2 Roles & Responsibilities

3 Asset Inventory

4 Firewall Policy

All internet-facing traffic is controlled by UFW (Uncomplicated Firewall) with a default-deny incoming policy. Only the following ports are permitted:

5 Secure Configuration

5.1 SSH Hardening

Root SSH login is disabled. Password authentication is disabled. The only accepted authentication method is a passphrase-protected RSA public key — providing two-factor access (something you have + something you know).

5.2 HTTP Security Headers

All HTTPS responses include the following security headers:

5.3 Application Security

• SQL injection: All database queries use parameterised prepared statements — user input is never interpolated into SQL strings
• XSS: EJS templating auto-escapes all output by default; Content Security Policy provides defence-in-depth
• CSRF: Session-bound tokens validated on all state-changing requests; SameSite=Lax cookies provide additional protection
• File uploads: MIME type and file extension whitelist (JPEG/PNG/GIF/WebP only); maximum 5MB
• Rate limiting: 10 login attempts per 15 minutes per IP address; 120 requests/minute global cap
• Session cookies: HttpOnly, Secure, SameSite=Lax — never accessible via JavaScript
• Multi-tenant isolation: Every database query is scoped by nursery ID — architecturally impossible for one nursery to access another's data

6 Access Control

6.1 Server Access

• One named administrator account — no shared server logins
• Authentication: RSA 2048 private key with passphrase (two factors)
• Root direct login disabled; privilege escalation via sudo only

6.2 Application — Staff

• Individual accounts per staff member — no shared logins
• 14 defined roles with least-privilege access enforced server-side
• Admin-only functions (settings, staff management) are restricted in code, not just hidden in the UI
• Account lockout: 5 failed login attempts triggers a 15-minute lockout
• Password policy: Minimum 10 characters, hashed with bcrypt (cost factor 12)
• When staff leave: account deactivated immediately — deactivated accounts cannot log in

6.3 Application — Parents

• Individual parent accounts with explicit portal access flag
• Same lockout policy as staff (5 attempts, 15 minutes)
• Parent access strictly limited to their own children's data

7 Malware Protection

• Scan scope: all application directories and web roots — covers all web application code
• Real-time detection: files are scanned on write, not just on schedule
• Detections are flagged immediately for manual review and deletion
• Monarx definitions updated automatically

8 Patch Management

8.1 Operating System

• Automatic: unattended-upgrades applies security patches daily from ubuntu-security
• Target: Security patches applied within 14 days of release (typically same-day via automation)
• Last full manual patch: 12 May 2026 — all packages current
• OS: Ubuntu 24.04 LTS — supported until April 2029

8.2 Application Dependencies

9 Data Protection & UK GDPR

9.1 Data categories processed

• Children's personal data (name, DOB, medical conditions, allergies, SEND needs)
• Parent/guardian personal data (name, email, phone)
• Staff personal data (name, email, DBS numbers, qualifications)
• Attendance, diary, incident and billing records

9.2 Lawful basis

• Processing under UK GDPR Article 6(1)(b) — contract performance and Article 6(1)(c) — legal obligation (Ofsted/EYFS requirements)
• Special category data (health/medical) under Article 9(2)(a) — explicit parental consent
• OurGrid acts as data processor; each nursery is the data controller

9.3 Technical measures

• At rest: AES-256 server disk encryption
• In transit: TLS 1.3, enforced via HSTS (1-year max-age with preload)
• Location: UK-hosted server — no transfers outside UK or EEA
• Sessions: Server-side only — no sensitive data stored in client cookies

9.4 Data retention & deletion

• Active child records retained for the duration of the nursery's subscription
• On account closure: data retained for 30 days then permanently deleted
• Earlier deletion available on request

9.5 Data Processing Agreement

A DPA is available on request and provided as standard to all Nursery, Professional and Enterprise plan customers. Contact hello@ournurserygrid.com to request a copy.

10 Incident Response

A security incident is defined as: unauthorised access, malware detection, data breach (actual or suspected), credential compromise, or denial of service.

11 Backup Policy

Automated daily backup runs at 02:00 BST to Cloudflare R2 (geographically separate from VPS host).

12 Review & Audit Schedule