Policies
Policies
The written internal policies that govern how PetroBench builds and operates the platform
PetroBench maintains written internal policies covering security, data handling, operations, and personnel. They are reviewed monthly. Policy names link to the published detail where it exists.
Security
| Policy | What it covers |
|---|---|
| Information Security | Infrastructure, encryption, and network controls |
| Access Control | Permissions, authentication, and production access |
| Change Management | How changes are reviewed, tested, and released |
| Endpoint Security | Hardening of company devices |
| Secrets Management | Where credentials are held and how leaks are caught |
| Logging and Audit | What activity is recorded and monitored |
| Vulnerability Disclosure | How vulnerabilities are reported and handled |
Data
| Policy | What it covers |
|---|---|
| Data Protection and Retention | Storage, residency, backups, export, and deletion |
| Data Classification | How customer data and analytics are classified |
| Privacy | Collection, use, and ownership of personal information |
| AI and Machine Learning | Use of customer data in AI-assisted features |
| Subprocessor Management | Third parties that process customer data |
Operations
| Policy | What it covers |
|---|---|
| Incident Response | Handling and communication of security and availability incidents |
| Business Continuity | Backups, recovery, and continuity of service |
| Service Availability | Uptime commitments, maintenance, and support response |
| Compliance and Assessment | Framework alignment and ongoing security testing |
| Risk Management | How security and reliability risks are tracked |
People and Use
| Policy | What it covers |
|---|---|
| Personnel Security | Screening, training, and access for employees and contractors |
| Acceptable Use | Permitted and prohibited use of the platform |
| Shared Responsibility | What PetroBench secures and what the customer controls |
Governance
Policies are owned by PetroBench leadership and reviewed monthly, and whenever our practices, infrastructure, or legal obligations change. Material changes to customer-facing policies are communicated by email.