Information Security Policy

Our Commitment

Logicode Logistics S.L. (hereinafter "Logicode") considers the security of information an essential element for earning the trust of clients, partners and stakeholders. This Information Security Policy establishes the reference framework for protecting the information and services we manage, guaranteeing appropriate levels of confidentiality, integrity, availability, authenticity and traceability, and supporting compliance with the Spanish National Security Framework (Esquema Nacional de Seguridad, ENS).

This Policy is the highest-level document of Logicode's information security management system and serves as the basis for the internal rules, procedures and evidence that develop it — including those required for the ENS accreditation and certification of the Garbo system.

Scope

This Policy applies to the entire organization — staff, collaborators, advisors and third parties who access Logicode's information or systems — and to all information assets (data, documentation, configurations, keys and source code), processes and systems. It applies specifically and as a priority to Garbo, our device-virtualization platform deployed on Google Cloud Platform, which is designed to meet the HIGH category of the ENS, across its production, pre-production and development environments.

Security Principles

Our security model is built on the following principles:

• Risk-based management: controls are prioritized according to their impact and likelihood.
• Security by design and by default: security requirements are embedded across the entire lifecycle.
• Defence in depth: complementary, layered protection.
• Need to know and least privilege: access is limited to the strict minimum required.
• Traceability and accountability: actions are attributable to unique, registered identities.
• Segregation of duties, with compensating controls where roles overlap.
• Continuous improvement: periodic review, audits and lessons learned.

Our Commitments

To protect information and minimize the risks associated with our systems and data processing, Logicode commits to:

• Guarantee the confidentiality, integrity, availability, authenticity and traceability of the information it manages.
• Comply with the applicable legislation and regulations on information security, data protection and privacy, in particular the ENS.
• Classify information and apply access controls based on the need-to-know and least-privilege principles, with unique identities and mandatory multi-factor authentication for critical services.
• Protect information in transit and at rest through encryption and appropriate key management.
• Maintain an up-to-date inventory of assets, each with an assigned owner and a classification level according to its sensitivity.
• Apply the shared-responsibility model in the cloud (Google Cloud Platform), maintaining a secure architecture with environment segregation, segmentation, audit logging and periodic security-posture reviews.
• Integrate security into the development lifecycle and protect the software supply chain, with traceable changes, code reviews and secure secret management.
• Generate, protect and retain the logs and audit trails required to monitor security and detect anomalous behaviour early.
• Manage security incidents through a documented process — detection, classification, containment, eradication and recovery — coordinating with providers and third parties when required.
• Ensure business continuity and perform regular backups with defined recovery objectives, testing restoration periodically — with particular attention to Garbo.
• Assess and monitor the security risks arising from suppliers, providers and third-party services.
• Promote security awareness and training among staff and collaborators on at least an annual basis.

Governance and Responsibilities

Logicode's management assumes information security as a strategic objective and commits to approving and disseminating this Policy, providing sufficient resources, requiring compliance and promoting continuous improvement. Security roles are defined in line with the ENS, and a Security Committee coordinates and reviews the state of risks, incidents and privileged access. Where a single person performs more than one role, Logicode applies documented compensating controls — dual control ("4-eyes") over critical actions, technical segregation through separate identities and permissions, reinforced traceability and periodic formal reviews — to preserve functional independence.

Compliance and Continuous Improvement

Compliance with this Policy is mandatory for all personnel and third parties within its scope. Logicode carries out internal reviews and audits, recording findings and action plans through to closure, and manages security as a cycle of continuous improvement that incorporates the lessons learned from incidents, audits and changes.

This page is a public summary of Logicode's internal Information Security Policy. For any related query you can contact us at [email protected].