Information security policy

LORENGRAFF ® is committed to protecting the company's information and digital assets, ensuring their confidentiality, integrity and availability. This policy sets out the guidelines and measures that safeguard our information systems and sensitive data.

Objectives

The main objectives of our Information Security Policy are to:

• Protect information assets against internal and external threats.
• Ensure information is available to authorized users when needed.
• Preserve the integrity of information and prevent unauthorized changes.
• Comply with applicable data protection and information security laws and regulations.

Scope

This policy applies to all employees, contractors and third parties with access to the information systems and data of LORENGRAFF ®, including:

• Computer systems and networks.
• Databases and information storage.
• Applications and web services used in the company's operations.

Responsibilities

Information security responsibilities are distributed as follows:

• Executive management: approve and periodically review the security policy.
• IT department: implement technical and administrative security measures.
• Employees: follow the established guidelines and report security incidents.

Security guidelines

To ensure information security, the following guidelines apply:

• Access control: limit access to information according to roles and job needs.
• Data protection: make sure personal and sensitive data are protected against unauthorized access.
• Password management: use strong passwords and change them periodically.
• Updates and patches: keep systems and applications up to date to mitigate vulnerabilities.
• Monitoring and auditing: log and audit activity on critical systems.
• Incident response: maintain procedures to identify, report and mitigate security incidents.

Legal compliance

LORENGRAFF ® complies with applicable data protection and information security laws and regulations, including:

• Dominican Republic Law No. 172-13 on the protection of personal data.
• The European Union General Data Protection Regulation (GDPR), when processing data of people in the EU.
• The Spanish Information Society Services and E-Commerce Act (LSSI-CE).
• Intellectual property law (LPI).

Measures applied on the LORENGRAFF Business platform

• HTTPS encryption for all communications.
• Integration tokens and credentials (Google, Meta, PayPal) stored encrypted and used only on the server.
• Panel access with authentication, login attempt limits and protected sessions.
• Signature verification of payment notifications received from PayPal.
• Use of Google data in accordance with the Google API Services User Data Policy, including the Limited Use requirements.
• Notification without undue delay to affected customers if a security breach occurs.

More information in our Privacy Policy.

Policy review

This policy is reviewed annually, or whenever significant changes occur in the information systems or applicable legislation, to ensure it remains effective and appropriate.

Reporting

To report misuse or abuse:

• By email: abuse@lorengraff.net
• On Telegram: @lorengraff

Responsible vulnerability disclosure

If you discover a vulnerability in lorengraff.net or any of its subdomains, email us at abuse@lorengraff.net. You can encrypt your message with our public PGP key (fingerprint E92F E04F 14B4 D40E E990 6E2C A400 3F07 B5FC F8A7). Security contact details are also published at /.well-known/security.txt (RFC 9116). Do not run tests that affect service availability or access third-party data.