SQUIRE Trust Center

• Data is classified by sensitivity, risk, and the compliance requirements that apply to it.
• Data loss prevention monitors for the movement of sensitive data.
• Client data may not be stored on laptops, tablets, phones, or removable media. It is accessed only within approved, secure environments.
• A documented retention and disposal policy defines which records are kept, for how long, and how they are destroyed.

• Client data sent over public networks is encrypted using TLS 1.2 or higher. SSL v2 and v3 are prohibited.
• Company laptops use full-disk encryption.
• Encryption uses industry-standard algorithms and strong key lengths, and key-length requirements are reviewed annually.

• Every user has a unique account, and single sign-on (SSO) is used for company applications.
• Two-factor authentication is required wherever it is supported, using an authenticator app or a hardware security key. SMS codes are not allowed.
• Access follows least privilege based on each person's role, and duties are separated where practical.
• Employee access is reviewed annually.
• Access is revoked when employment ends, and the person's company devices are locked or signed out.

• Employees use company-issued computers, centrally managed with mobile device management (MDM).
• Company systems can't be reached from personal computers; access requires a company-managed device.
• Endpoints run anti-malware with behavior-based detection and blocking.
• USB devices are managed on company computers and can be locked.

• Dynamic application security testing (DAST) checks SQUIRE's web application for vulnerabilities, including the OWASP categories.
• Systems are scanned for exploitable vulnerabilities, both internally and externally.
• Penetration testing is performed to identify weaknesses in SQUIRE's systems.

• A web application firewall (WAF) protects SQUIRE's web applications against attacks such as cross-site scripting and SQL injection.
• DDoS mitigation protects SQUIRE's services from denial-of-service attacks.

• Vendor advisories and vulnerability databases are monitored for security updates that affect SQUIRE's systems.
• Patches are prioritized by severity (CVSS), exploitability, and business impact. Critical patches can be deployed outside scheduled maintenance.
• Patch deployment is tracked and documented.

• Security events are monitored continuously and assessed using log review and threat intelligence.
• Security audit logs are collected centrally, protected from modification, restricted to people who need them, and reviewed each business day.
• A documented incident response plan defines how incidents are classified, escalated, and resolved.
• Significant incidents are followed by a post-incident review.

• Security policies are documented and reviewed at least annually.
• All employees complete security awareness training every year.
• Every third-party vendor that integrates with SQUIRE systems or data goes through a security review.
• SQUIRE maintains documented business continuity and disaster recovery plans.

SQUIRE does not store, process, or transmit cardholder data. Card payments are processed by Stripe.

When a card payment is taken, the customer is redirected to Stripe's payment page, so card details are entered with Stripe rather than in SQUIRE's systems.

Compliant with PCI DSS v4.0.1 as a merchant, validated through a Report on Compliance by Coalfire Systems, Inc., a Qualified Security Assessor. Report dated September 11, 2026.

Available on request under a mutual non-disclosure agreement (MNDA).

• Request the AOC

Client data sent over public networks is encrypted using TLS 1.2 or higher. SSL v2 and v3 are prohibited.

Company laptops use full-disk encryption.

Two-factor authentication is required wherever it is supported, using an authenticator app or a hardware security key. SMS codes are not allowed.