Security Policy
Last Updated: November 6, 2025
This Security Policy describes the measures Ronviro takes to protect the confidentiality, integrity, and availability of user data and platform infrastructure. By using our services, you acknowledge that you have read and understood this policy.
1. Scope
This policy applies to all systems, services, and data managed by Ronviro, including our web platform, course delivery infrastructure, user accounts, and any third-party integrations used to operate our services.
2. Data Protection Principles
We apply the following core principles when handling user data:
Confidentiality: Access to personal and sensitive data is restricted to authorised personnel only. Data is not disclosed to third parties without a lawful basis or explicit user consent.
Integrity: We implement controls to prevent unauthorised modification of data. Changes to critical records are logged and auditable.
Availability: We maintain infrastructure redundancy and monitoring to ensure service uptime and data accessibility for legitimate users.
3. Access Control
3.1 User Authentication
User accounts are protected by password-based authentication. Passwords are stored using industry-standard one-way hashing algorithms. Users are encouraged to choose strong, unique passwords and to avoid reusing credentials across services.
3.2 Administrative Access
Administrative access to production systems is restricted to a minimal number of authorised personnel. All administrative sessions are conducted over encrypted connections. Access rights are reviewed periodically and revoked promptly upon role changes or termination.
3.3 Least Privilege
Internal staff and systems are granted only the minimum level of access required to perform their functions. Privilege escalation requires documented justification and approval.
4. Data Transmission Security
All data transmitted between users and our platform is encrypted using Transport Layer Security (TLS). We enforce secure connections and do not support outdated or deprecated protocol versions. Sensitive data is never transmitted over unencrypted channels.
5. Data Storage Security
Data at rest is stored on secured infrastructure with access controls, encryption where appropriate, and physical security measures applied at the hosting provider level. We use reputable cloud infrastructure providers that maintain their own compliance certifications.
6. Vulnerability Management
6.1 Software Updates
We maintain a process for regularly applying security patches and updates to operating systems, application dependencies, and third-party libraries. Critical patches are prioritised and applied promptly upon release.
6.2 Security Testing
We conduct periodic security assessments, including code reviews and testing for common vulnerabilities such as those identified in the OWASP Top Ten. Identified issues are triaged and remediated according to severity.
6.3 Dependency Monitoring
We monitor third-party dependencies for known vulnerabilities using automated tooling and update affected components as part of our standard release process.
7. Incident Response
We maintain an incident response process to detect, contain, investigate, and remediate security incidents. In the event of a confirmed data breach that affects user data, we will notify affected users and relevant parties within a reasonable timeframe in accordance with applicable obligations. Notifications will include the nature of the incident, data affected, and steps taken in response.
8. Third-Party Services
We integrate with third-party service providers for functions such as payment processing, email delivery, and analytics. These providers are selected based on their security posture and are required to handle data in a manner consistent with this policy. We do not sell or rent user data to third parties.
9. Employee and Contractor Security
All personnel with access to user data or production systems are subject to confidentiality obligations. Staff receive guidance on data handling responsibilities and security practices. Access is promptly revoked upon departure or change of role.
10. Physical Security
Our platform is hosted in data centres operated by reputable providers that implement physical access controls, environmental monitoring, and redundancy measures. Ronviro does not operate its own data centre facilities.
11. Backup and Recovery
We maintain regular backups of critical data. Backups are stored securely and tested periodically to verify recoverability. Our recovery procedures are designed to minimise data loss and restore service availability in the event of a failure or incident.
12. Reporting Security Concerns
If you discover a potential security vulnerability or have concerns about the security of our platform, please contact us as soon as possible. We ask that you refrain from publicly disclosing any vulnerability until we have had a reasonable opportunity to investigate and address it.
You can reach our team at:
Email: contact@ronviro.online
Phone: +441322556559
Address: 4 Puffin Cl, Barking IG11 0GT, United Kingdom
13. Changes to This Policy
We may update this Security Policy from time to time to reflect changes in our practices, technology, or applicable requirements. The date at the top of this page indicates when the policy was last revised. Continued use of our services following any update constitutes acceptance of the revised policy.
14. Contact
For questions or concerns related to this Security Policy, please contact us using the details provided in Section 12 above.