Security Policy

Last Updated: November 29, 2024

Tourismre is committed to protecting the security of our platform, our users, and the data entrusted to us. This Security Policy describes the measures we take to safeguard our systems and the responsibilities of users in maintaining a secure environment.

1. Scope

This policy applies to all systems, services, and infrastructure operated by Tourismre under the domain tourismre.com, including all web applications, APIs, databases, and communication channels used to deliver our online learning platform.

2. Data Protection and Encryption

2.1 Data in Transit

All data transmitted between users and our platform is encrypted using industry-standard Transport Layer Security (TLS). We enforce HTTPS across all pages and services and do not permit unencrypted connections.

2.2 Data at Rest

Sensitive data stored on our systems is encrypted using strong encryption algorithms. Encryption keys are managed through dedicated key management processes with strict access controls and regular rotation schedules.

2.3 Database Security

Our databases are hosted in isolated network environments. Direct public access to database servers is not permitted. All database connections require authentication and use encrypted channels.

3. Access Control

3.1 Principle of Least Privilege

Access to systems and data is granted on a need-to-know basis. Employees and contractors are provided only the minimum level of access required to perform their duties.

3.2 Authentication

Internal systems require strong authentication mechanisms including multi-factor authentication for administrative and privileged access. User accounts on the platform are protected by password policies that enforce minimum complexity requirements.

3.3 Access Reviews

Access rights are reviewed periodically. Access is revoked promptly upon termination of employment or when no longer required for operational purposes.

4. Infrastructure Security

4.1 Network Segmentation

Our infrastructure is segmented into distinct network zones. Production environments are isolated from development and testing environments. Firewalls and security groups restrict traffic to only what is necessary for operations.

4.2 Monitoring and Logging

We maintain comprehensive logging of system activity, access events, and security-relevant actions. Logs are stored securely and monitored for anomalous behaviour. Alerts are configured to notify our security team of potential incidents in real time.

4.3 Vulnerability Management

We conduct regular vulnerability assessments and apply security patches in a timely manner. Critical patches are prioritised and applied as quickly as operationally feasible. Third-party dependencies are monitored for known vulnerabilities.

4.4 Penetration Testing

Periodic penetration testing is performed on our platform and infrastructure. Findings are remediated according to their severity and risk level.

5. Application Security

5.1 Secure Development Practices

Our development team follows secure coding standards throughout the software development lifecycle. Code reviews include security considerations, and automated security scanning tools are integrated into our development pipeline.

5.2 Input Validation

All user-supplied input is validated and sanitised before processing. We implement protections against common web application vulnerabilities including injection attacks, cross-site scripting, and cross-site request forgery.

5.3 Session Management

User sessions are managed with secure, randomly generated tokens. Sessions expire after periods of inactivity, and mechanisms are in place to allow users to terminate active sessions.

6. Incident Response

6.1 Detection and Response

We maintain an incident response process to detect, contain, investigate, and remediate security incidents. Our security team is responsible for coordinating the response to any confirmed or suspected security event.

6.2 Notification

In the event of a security incident that affects user data, we will notify affected users in accordance with our obligations and without undue delay. Notifications will describe the nature of the incident, the data involved, and the steps we are taking in response.

6.3 Post-Incident Review

Following any significant security incident, a post-incident review is conducted to identify root causes and implement improvements to prevent recurrence.

7. Third-Party Security

We assess the security practices of third-party service providers before engagement. Vendors who process or have access to user data are required to maintain appropriate security standards. We review third-party security posture on an ongoing basis and include security obligations in our agreements with vendors.

8. Physical Security

Our platform is hosted in data centres that maintain physical security controls including restricted access, surveillance, and environmental protections. Physical access to server infrastructure is limited to authorised personnel only.

9. Employee Security

All employees and contractors with access to systems or data receive security awareness training. Background checks are conducted in accordance with applicable requirements. Employees are required to comply with our internal security policies and procedures.

10. Business Continuity and Backup

We maintain regular backups of critical data and systems. Backups are stored securely and tested periodically to verify integrity and recoverability. We maintain business continuity plans to support the restoration of services in the event of a disruption.

11. User Responsibilities

Users of our platform share responsibility for maintaining security. We ask that users:

• Use strong, unique passwords for their accounts
• Do not share account credentials with others
• Log out of their accounts when using shared or public devices
• Report any suspicious activity or suspected security issues promptly
• Keep their contact information up to date to receive security notifications

12. Reporting Security Vulnerabilities

We encourage responsible disclosure of security vulnerabilities. If you discover a potential security issue affecting our platform, please contact us before disclosing it publicly so that we have the opportunity to investigate and remediate the issue.

Security concerns can be reported to us at:

We will acknowledge receipt of your report and keep you informed of our progress in addressing the issue. We do not pursue legal action against individuals who report vulnerabilities in good faith and in accordance with this policy.

13. Policy Review and Updates

This Security Policy is reviewed at least annually and updated as necessary to reflect changes in our practices, technology, or the threat landscape. Material changes will be communicated through our platform or by direct notification. Continued use of our services following any update constitutes acceptance of the revised policy.

14. Contact

For questions or concerns regarding this Security Policy, please contact us: