Security

Security is a fundamental component of the design, development, operation, and continuous improvement of Workspace. Because Workspace may process sensitive business information, communications, meeting content, documents, recordings, transcripts, personal information, account information, and other confidential material, Ann-Connect takes a defence-in-depth approach to protecting the confidentiality, integrity, and availability of information processed through the platform.

Our security approach combines technical safeguards, organisational controls, access management, secure software development practices, infrastructure protection, monitoring, incident response, data protection measures, and ongoing security improvement. We aim to ensure that security is considered throughout the lifecycle of information, from collection and transmission through processing, storage, access, retention, and eventual deletion.

Workspace is designed to operate on secure cloud infrastructure and uses appropriate controls intended to protect the underlying systems and services supporting the platform. These controls may include network security mechanisms, infrastructure isolation, firewalls and access controls, secure configuration practices, system monitoring, vulnerability management, logging, backup mechanisms, redundancy, and other measures appropriate to the nature and sensitivity of the services provided.

Ann-Connect continuously evaluates the security of its infrastructure and platform components and may introduce additional controls as technology, threats, regulatory requirements, and industry practices evolve.

Where appropriate, Workspace uses encryption and secure communication protocols to protect information while it is transmitted between users, devices, applications, and platform infrastructure. Appropriate protections are also applied to stored information based on the nature of the data, the service involved, and the underlying infrastructure.

Encryption is one component of Workspace's broader security architecture and is supported by access controls, authentication mechanisms, monitoring, secure key-management practices, system hardening, and other safeguards designed to reduce the risk of unauthorised access or disclosure.

Workspace uses access-control mechanisms designed to ensure that users and authorised personnel can access only the information and functionality necessary for their role. Depending on the Workspace service and subscription, these controls may include role-based permissions, administrative controls, authentication mechanisms, session controls, account-management capabilities, and other identity and access-management features.

Enterprise customers may configure user roles and permissions to reflect their internal organisational structures. Customers are responsible for appropriately managing user accounts, administrator privileges, authentication settings, access permissions, and the timely removal or modification of access when personnel change roles or leave the organisation.

Access to customer information by Ann-Connect personnel is restricted according to legitimate business and operational requirements. Where access is necessary for purposes such as technical support, security investigations, maintenance, incident response, service administration, or other authorised operational activities, access is subject to appropriate controls and confidentiality obligations.

Ann-Connect seeks to apply the principle of least privilege, meaning that access should be limited to the minimum level reasonably necessary for the relevant task. Administrative and privileged access may also be subject to additional authentication, logging, monitoring, and review mechanisms.

Security considerations are incorporated into the development and maintenance of Workspace. Ann-Connect seeks to identify and address security risks throughout the software development lifecycle, including during application design, development, testing, deployment, maintenance, and updates.

Security practices may include secure coding principles, dependency management, vulnerability assessment, code review, security testing, access-control testing, configuration management, and remediation of identified vulnerabilities according to their severity and potential impact.

Workspace maintains technical and security-related logs to support system operation, troubleshooting, security monitoring, incident investigation, fraud prevention, and accountability. Depending on the service and configuration, logs may include authentication activity, administrative actions, system events, access events, configuration changes, and other relevant technical information.

Audit and security logs are protected using appropriate access restrictions and security controls. Retention periods may vary according to the purpose of the information, applicable legal or contractual requirements, operational requirements, and the relevant Workspace service.

Ann-Connect uses monitoring and detection mechanisms intended to identify unusual, suspicious, unauthorised, or potentially malicious activity affecting Workspace. Security events may be investigated and, where appropriate, mitigated through measures such as access restriction, account suspension, configuration changes, system isolation, remediation, or other incident-response actions.

Because no internet-connected system can be guaranteed to be completely immune from security threats, Ann-Connect continually reviews its security posture and implements improvements intended to reduce the likelihood and potential impact of security incidents.

Workspace is designed with operational resilience in mind. Depending on the service, data and system components may be supported by backup, redundancy, recovery, and fault-tolerance mechanisms designed to reduce the impact of infrastructure failures, software failures, accidental deletion, or other operational disruptions.

Backup and recovery arrangements may differ between Workspace services and subscription levels. Backups are primarily intended to support service continuity and recovery and should not be interpreted as an unlimited archival service or as a replacement for a customer's own records-management and backup obligations where such obligations apply.

Ann-Connect maintains processes for identifying, assessing, containing, investigating, responding to, and recovering from security incidents. Where an incident involves unauthorised access to, disclosure of, alteration of, loss of, or destruction of personal information, Ann-Connect will assess the incident and take appropriate steps in accordance with applicable law and contractual obligations.

Where a customer is the responsible party or controller for personal information processed through Workspace, Ann-Connect will provide appropriate assistance and information where required to enable the customer to meet its own legal and regulatory obligations. Where notification is legally required, Ann-Connect will notify the relevant customer, regulator, or affected individuals in accordance with applicable law and within the applicable legal or contractual timeframes.

Workspace may use third-party infrastructure, software, cloud services, payment services, communication services, AI technologies, integrations, and other technology providers to deliver particular functionality. Where such providers process information on behalf of Ann-Connect or are otherwise involved in the delivery of Workspace services, Ann-Connect seeks to assess their suitability and apply appropriate contractual and security requirements based on the nature of the services provided.

Customers should also understand that when they voluntarily enable a third-party integration, invite external participants, or transfer information to an external service, that information may become subject to the security and privacy practices of that third party.

Certain Workspace services, including Nexa AI and AI-enabled functionality within Room, may process meeting content, prompts, documents, transcripts, conversations, summaries, actions, and other information in order to provide AI-assisted functionality. Access to AI functionality is subject to applicable Workspace permissions, configuration, service terms, and technical safeguards.

Ann-Connect seeks to ensure that AI functionality is operated in a manner consistent with applicable privacy, confidentiality, and security requirements. Customers should nevertheless avoid submitting information to AI features where they are prohibited from doing so under their own internal policies, contractual obligations, or applicable law, unless the relevant Workspace configuration and contractual arrangements expressly support such processing.

Security is a shared responsibility between Ann-Connect and the customer. While Ann-Connect is responsible for the security of the Workspace services and infrastructure within its control, customers remain responsible for the security of their own accounts, devices, networks, credentials, users, configurations, integrations, and information that they choose to upload or share through the platform.

Customers should maintain appropriate password and authentication practices, restrict administrator privileges, manage user access appropriately, protect authentication credentials, maintain secure devices, promptly remove inactive users, configure available security controls, and notify Ann-Connect promptly if they suspect that an account or Workspace environment has been compromised.

Security is not treated as a one-time implementation. Ann-Connect continually evaluates the threat landscape, platform architecture, vulnerabilities, operational risks, and emerging security practices in order to strengthen Workspace over time. Security controls may therefore evolve as new technologies, threats, vulnerabilities, regulatory expectations, and industry standards develop.

Our objective is to provide organisations with a Workspace environment that is secure, resilient, privacy-conscious, and suitable for modern collaboration, while recognising that no technology platform can guarantee absolute security or eliminate every possible risk.

Enterprise security documentation: Where appropriate and subject to confidentiality, customer requirements, and the nature of the engagement, Ann-Connect may provide enterprise customers with additional information regarding security controls, infrastructure, data processing arrangements, sub-processors, compliance measures, business continuity, and other security practices as part of the customer's procurement or security-assessment process.