Book a demo

Policies · Information security

Information security

You give us access to the systems your organisation depends on. Protecting your information is built into how we design our products and how we run our business.

Last reviewed: October 2026 · Next review: October 2027

01Purpose and scope

This policy sets out how Legacy Software Limited protects the confidentiality, integrity and availability of information: our own, and the information our customers entrust to us. It applies to everyone who works for us or on our behalf, to every system and device used for our work, and to all information in any form.

It works alongside our privacy policy, which covers personal data. Our approach follows recognised good practice, including the principles of ISO/IEC 27001.

02Our commitments

  • Confidentiality: information is seen only by people who need it for their work.
  • Integrity: information is accurate and complete, and is changed only by people allowed to change it.
  • Availability: information and systems are there when they are needed.
  • We assess information security risks regularly and treat them in proportion to the harm they could cause.
  • We meet our legal, regulatory and contractual obligations, including the UK GDPR and the Data Protection Act 2018.

03Security by design in our products

Our products are designed so that customers keep control of their systems and data.

  • Your data stays with you. The Legacy Directory and the Naming Workbench run inside your own environment, in your data centre or your cloud. We do not host your systems or take copies of them to provide the products.
  • Read-only analysis. The Legacy Directory documents applications by reading source code and system definitions; it does not change running systems.
  • Names, not values. The Naming Workbench works from field names, formats and comments. It does not need, or read, the data held in those fields.
  • AI is off until you switch it on. Optional AI suggestions are disabled by default. If you enable them, you choose the provider and what is sent, and every suggestion still needs a person’s approval.
  • Secure by default. Passwords are stored only as strong one-way hashes, secrets are encrypted, access is controlled by role with separation of duties, sign-in can use your own single sign-on, and security events and decisions are logged for audit.

04Access control

  • Access to systems and information is granted on a least-privilege, need-to-know basis, and reviewed regularly.
  • Everyone has their own account; shared accounts are not used.
  • Strong, unique passwords and multi-factor authentication are required wherever a service supports them.
  • Access is removed promptly when someone leaves or changes role.

05Devices and networks

  • Laptops and other devices used for work have encrypted storage, a screen lock, up-to-date security software, and an operating system and applications that are supported and kept patched.
  • Lost or stolen devices are reported immediately so that access can be revoked.
  • Work is carried out over encrypted connections; public networks are used only with appropriate protection.

06Customer information

Sometimes a customer gives us information to help with installation or support, such as configuration details, logs or extracts of source code. We use it only for the purpose it was given, keep it only on approved, encrypted systems, share it only with the people who need it, and securely delete it when it is no longer needed, or as our contract requires. When we work on a customer’s systems we follow the customer’s own security policies and instructions.

07Secure development

  • Source code is held in version control, with every change recorded.
  • Automated tests, including security-relevant tests of sign-in, roles and data handling, run before every release.
  • Third-party components are chosen with care and kept up to date.
  • Releases are published with checksums so that customers can confirm what they install is exactly what we built.
  • Licence signing keys are kept offline and separate from our source code.

08Suppliers and cloud services

We use suppliers and cloud services only after checking that their security is appropriate for what they will do. Where a supplier handles personal data for us, we have a written agreement that meets data protection law.

09Incidents

Everyone must report a suspected security incident, such as a lost device, a suspicious email or unexpected access, to a director immediately. We will contain and investigate it, learn from it, and tell affected customers without undue delay. Where personal data is involved, we will notify the Information Commissioner’s Office within 72 hours where the law requires it.

10Business continuity and backups

Our source code, records and business systems are backed up regularly to secure, separate locations, and we test that backups can be restored. We plan so that we can continue to support our customers if a system, a supplier or an office becomes unavailable.

11Training and awareness

Everyone who works for us is briefed on this policy when they join and receives security awareness training every year, including how to recognise phishing and social engineering.

12Breaches and review

Breaching this policy may lead to disciplinary action. The directors are responsible for information security and review this policy every year, and after any significant incident or change.

Customers with security questions, or completing a supplier security questionnaire, are welcome to contact us at support@legacysoftware.co.uk.

Approved by the directors of Legacy Software Limited. This policy is reviewed every year, and sooner if the law or our business changes.