Pomelo Technology US Inc (LemFi) | Trust Center
Security
Your data deserves the highest level of care - and that’s exactly what we deliver. At our Trust Center, discover how we safeguard your information with industry-leading security, unwavering integrity, and always-on availability. Explore our commitment to transparency, compliance, and world-class data protection.
See Resources

Resources

SOC2 Type 2

SOC 2 Type II - Bridge Letter

PCI DSS Certificate

PCI DSS AOC Report

Privacy Policy

Terms of Service

FAQs

Our infrastructure is hoseted in Amazon Web Services (AWS) Cloud Platform. AWS ensures compliance with PCI DSS Level 1, ISO 27001, and SOC standards.
The data is encryted at rest using AES-256. Transmission of data occurs via HTTPS using TLS 1.2+
To report vulnerabilities, please use the link below. For detailed guidelines and more information, refer to our policy at the link here: https://client.inspectiv.com/vdp/lemfi
LemFi maintains formal controls and monitoring capabilities to identify, detect, and escalate potential or confirmed information security incidents, including data breaches, to the Information Security function in a timely manner. Security telemetry and audit logs from critical systems are centrally aggregated within the enterprise SIEM platform for continuous correlation, monitoring, and threat detection. Log sources include, but are not limited to, network traffic flow logs, Web Application Firewall (WAF) events, authentication and access logs, and infrastructure or instance event logs. The SIEM environment is monitored by the Security Operations function, with alerts triaged, investigated, remediated, and escalated in accordance with established incident response and security operations procedures.

Monitoring

Continuously monitored by Secureframe

Compliance

SOC 2

PCI

GDPR

Monitoring

Change Management

Configuration and Asset Management Policy
A Configuration and Asset Management Policy governs configurations for new sensitive systems
Segregation of Environments
Development, staging, and production environments are segregated.
Production Data Use is Restricted
Production data is not used in the development and testing environments, unless required for debugging customer issues.
Change Management Policy
A Change Management Policy governs the documenting, tracking, testing, and approving of system, network, security, and infrastructure changes.

Availability

Business Continuity and Disaster Recovery Policy
Business Continuity and Disaster Recovery Policy governs required processes for restoring the service or supporting infrastructure after suffering a disaster or disruption.
Testing the Business Continuity and Disaster Recovery Plan
The Business Continuity and Disaster Recovery Plan is periodically tested via tabletop exercises or equivalents. When necessary, Management makes changes to the Business Continuity and Disaster Recovery Plan based on the test results.
Backup Restoration Testing
Backed-up data is restored to a non-production environment at least annually to validate the integrity of backups.

Organizational Management

Acceptable Use Policy
An Acceptable Use Policy defines standards for appropriate and secure use of company hardware and electronic systems including storage media, communication tools and internet access.
Information Security Policy
An Information Security Policy establishes the security requirements for maintaining the security, confidentiality, integrity, and availability of applications, systems, infrastructure, and data.
Cybersecurity Insurance
Cybersecurity insurance has been procured to help minimize the financial impact of cybersecurity loss events.

Confidentiality

Data Classification Policy
A Data Classification Policy details the security and handling protocols for sensitive data.
Data Retention and Disposal Policy
A Data Retention and Disposal Policy specifies how customer data is to be retained and disposed of based on compliance requirements and contractual obligations.

Vulnerability Management

Third-Party Penetration Test
A 3rd party is engaged to conduct a network and application penetration test of the production environment at least annually. Critical and high-risk findings are tracked through resolution.
Vulnerability and Patch Management Policy
A Vulnerability Management and Patch Management Policy outlines the processes to efficiently respond to identified vulnerabilities.

Incident Response

Incident Response Plan
An Incident Response Plan outlines the process of identifying, prioritizing, communicating, assigning and tracking confirmed incidents through to resolution.
Incident Response Plan Testing
The Incident Response Plan is periodically tested via tabletop exercises or equivalents. When necessary, Management makes changes to the Incident Response Plan based on the test results.

Risk Assessment

Vendor Risk Management Policy
A Vendor Risk Management Policy defines a framework for the onboarding and management of the vendor relationship lifecycle.
Risk Assessment and Treatment Policy
A Risk Assessment and Treatment Policy governs the process for conducting risk assessments to account for threats, vulnerabilities, likelihood, and impact with respect to assets, team members, customers, vendors, suppliers, and partners. Risk tolerance and strategies are also defined in the policy.

Network Security

Network Security Policy
A Network Security Policy identifies the requirements for protecting information and systems within and across networks.

Access Security

Complex Passwords
Personnel are required to use strong, complex passwords and a second form of authentication to access sensitive systems, networks, and information
Access to Product is Restricted
Non-console access to production infrastructure is restricted to users with a unique SSH key or access key