Security Policy
Last updated: 13 March 2024
Bright Path is committed to maintaining the security, integrity, and confidentiality of information processed through its platform. This Security Policy describes the technical and organisational measures we apply to protect our systems and the data entrusted to us by users, learners, and partners worldwide.
1. Scope
This policy applies to all systems, infrastructure, applications, and services operated by Bright Path, including the platform accessible at voltrushvanta.online, associated subdomains, APIs, and internal tooling used to deliver our educational services.
2. Information Security Principles
Our security programme is built on three foundational principles:
Confidentiality — Information is accessible only to those who are authorised to access it.
Integrity — Information and systems are accurate, complete, and protected from unauthorised modification.
Availability — Systems and data are available to authorised users when needed, with resilience against disruption.
3. Access Control
3.1 User Authentication
All user accounts require a unique identifier and password. Passwords are stored using industry-standard one-way cryptographic hashing. Users are encouraged to enable multi-factor authentication where available. Session tokens are issued with limited lifetimes and invalidated upon logout.
3.2 Administrative Access
Access to production systems is restricted to authorised personnel only. Administrative access requires strong authentication and is granted on a least-privilege basis. All administrative actions are logged and subject to periodic review.
3.3 Role-Based Permissions
Access rights are assigned according to defined roles. Permissions are reviewed when roles change and revoked promptly upon termination of employment or engagement.
4. Data Encryption
4.1 Data in Transit
All data transmitted between users and our platform is encrypted using TLS 1.2 or higher. We enforce HTTPS across all public-facing endpoints and reject insecure protocol versions.
4.2 Data at Rest
Sensitive data stored in our databases and file systems is encrypted using AES-256 or equivalent standards. Encryption keys are managed separately from the data they protect and are rotated on a defined schedule.
5. Network and Infrastructure Security
Our infrastructure is hosted with reputable cloud providers that maintain recognised security certifications. We employ network segmentation, firewalls, and intrusion detection mechanisms to monitor and restrict traffic. Access to internal networks is controlled through VPN and IP allowlisting where appropriate.
Regular vulnerability scans are performed on our network perimeter. Critical findings are remediated according to a defined severity-based timeline.
6. Application Security
6.1 Secure Development
Security considerations are integrated into our software development lifecycle. Developers follow secure coding guidelines. Code changes are reviewed before deployment, and automated scanning tools are used to identify common vulnerabilities.
6.2 Dependency Management
Third-party libraries and dependencies are monitored for known vulnerabilities. Updates and patches are applied in a timely manner based on assessed risk.
6.3 Input Validation
All user-supplied input is validated and sanitised on the server side. We apply protections against common web application vulnerabilities including injection attacks, cross-site scripting, and cross-site request forgery.
7. Vulnerability Management
We conduct periodic security assessments of our platform and infrastructure. Identified vulnerabilities are triaged, prioritised by severity, and remediated within defined timeframes. We maintain a process for receiving and evaluating externally reported security concerns.
If you believe you have identified a security vulnerability in our platform, please contact us at info@brightpath.com. We ask that you provide sufficient detail to reproduce the issue and allow us reasonable time to investigate before any public disclosure.
8. Incident Response
We maintain a documented incident response plan that defines roles, communication procedures, and remediation steps. In the event of a confirmed security incident affecting user data, we will:
— Contain and investigate the incident promptly.
— Notify affected users and relevant parties as required and without undue delay.
— Take corrective action to prevent recurrence.
— Document findings and update controls accordingly.
9. Third-Party Service Providers
We work with third-party providers for services including hosting, payment processing, and analytics. These providers are evaluated for their security practices before engagement. Where applicable, data processing agreements are in place to define responsibilities and obligations. We do not permit third parties to use data shared with them for purposes beyond those required to deliver their service.
10. Physical Security
Our services are delivered through cloud infrastructure. Physical access to data centre facilities is controlled by our infrastructure providers, who maintain appropriate physical security controls including access logging, surveillance, and environmental protections.
11. Business Continuity and Backup
We maintain regular backups of critical data. Backups are encrypted and stored in geographically separated locations. Recovery procedures are tested periodically to verify that data can be restored within acceptable timeframes in the event of system failure or data loss.
12. Employee Security
All personnel with access to systems or user data receive security awareness training. Background checks are conducted where appropriate and permitted. Employees are required to adhere to internal security policies and to report suspected incidents or policy violations promptly.
13. Logging and Monitoring
System and application events are logged to support security monitoring and forensic investigation. Logs are protected from unauthorised modification and retained for a defined period. Automated alerting is in place for anomalous activity patterns.
14. Security Certifications and Assessments
We rely on infrastructure providers that hold recognised security certifications. Our own security controls are reviewed and improved on an ongoing basis. We may engage independent assessors to conduct security audits or penetration tests as part of our continuous improvement programme.
15. Changes to This Policy
We may update this Security Policy from time to time to reflect changes in our practices, technology, or applicable requirements. The date at the top of this page indicates when the policy was last revised. We encourage users to review this policy periodically.
16. Contact
If you have questions about this Security Policy or wish to report a security concern, please contact us: