Information Security Policy

1. Purpose

This policy sets out the principles and controls S3 Chile uses to protect the confidentiality, integrity and availability of the information it handles in software development, contact center operations and AI auditing services.

2. Scope

It applies to all S3 Chile employees, contractors and suppliers, and to every information asset: systems, applications, client data, recordings, sales records and documentation, in any medium.

3. Principles

• Confidentiality: information is only accessible to those who need it for their role.
• Integrity: data is kept accurate, complete and traceable.
• Availability: services and data are available when required.
• Least privilege and minimal collection: only what is needed is accessed and collected.
• Continuous improvement: controls are reviewed and updated regularly.

4. Roles and responsibilities

Management approves this policy and allocates the necessary resources. The information security officer coordinates controls, risk management and training. Every employee is responsible for complying with this policy and reporting any incident or suspicion.

5. Information classification

Information is classified by criticality to define the level of protection required:

• Public: may be shared without restrictions.
• Internal: for the organization’s exclusive use.
• Confidential: client data, sales, recordings and credentials.
• Restricted: information whose disclosure would cause serious harm.

6. Access control

Access to systems and data is granted by role, with strong authentication and multi-factor authentication where applicable. Access is reviewed regularly and revoked immediately when an employment or contractual relationship ends.

Data is encrypted in transit and at rest, and credentials and secrets are managed in secure vaults, never in code or repositories.

7. Personal data processing

S3 Chile processes personal data in accordance with Chilean Law No. 19.628 on the protection of privacy and Law No. 21.719, as it enters into force. Data received through the contact form is used only to respond to your request and is not shared with third parties outside the delivery of the service.

You may request access, rectification, deletion or objection by writing to contacto@s3chile.cl.

8. Incident management

Every security incident is recorded, assessed, contained and analyzed to prevent recurrence. Where applicable, clients and the competent authorities are notified in a timely manner.

9. Business continuity

We maintain verified backups, disaster recovery plans and periodic testing to ensure the continuity of critical services.

10. Suppliers and third parties

Suppliers that access S3 Chile information must accept confidentiality clauses and security requirements equivalent to this policy, and are assessed before and during the engagement.

11. Review and compliance

This policy is reviewed at least once a year or when significant changes occur. Non-compliance may lead to disciplinary or contractual measures as appropriate.

12. Contact

Questions about this policy: contacto@s3chile.cl · Santiago, Chile.