Data Security

Last updated Nov 3, 2026

IGEN recognizes that protecting client information is fundamental to the services we provide. We maintain a risk-based information security program designed to protect the confidentiality, integrity, privacy, and availability of the information entrusted to us.

Our security program combines administrative, technical, and physical safeguards across our people, processes, applications, infrastructure, and service providers. These safeguards are reviewed and improved as technology, business requirements, client expectations, and security threats evolve.

Identity and Access Protection

IGEN applies identity and access controls designed to ensure that users receive access appropriate to their responsibilities.

• Unique user identities
• Role-based access controls
• Least-privilege access
• Segregation of administrative responsibilities
• Multi-factor authentication for supported high-risk, administrative, remote, and client-access scenarios
• Additional controls for privileged access
• Periodic review and removal of access when it is no longer required

Privileged access is limited to authorized personnel and is granted or activated according to the operational responsibilities of the individual.

Data Protection and Segregation

IGEN applies layered safeguards to protect client information throughout its use, transmission, storage, backup, and disposal.

• Encryption of data in transit using secure communication protocols
• Encryption of sensitive data at rest where supported and applicable
• Logical separation of client environments and information
• Network and application access restrictions
• Role-based access to client information
• Controlled administrative access
• Security logging and monitoring
• Backup and recovery protections
• Documented data retention and disposal requirements

Client information is retained according to applicable contractual, legal, regulatory, and operational requirements. Access to client information is limited to authorized individuals and systems with a legitimate business purpose.

Secure Software Development

IGEN incorporates security practices into its software development lifecycle.

• Peer review of application changes
• Automated source-code security analysis
• Third-party dependency and software component analysis
• Detection of exposed credentials and secrets
• Testing before production release
• Change-management and release controls
• Tracking and remediation of identified vulnerabilities
• Separation of development, testing, and production responsibilities where appropriate

Security findings are evaluated based on factors such as severity, exploitability, exposure, affected information, and potential business impact.

Security Monitoring and Threat Protection

IGEN works with enterprise security and technology teams to monitor systems, applications, endpoints, and security telemetry for suspicious activity and potential threats.

• Network firewalls and access restrictions
• Endpoint and workload protection
• Security event logging
• Centralized security monitoring and analysis
• Vulnerability scanning
• Threat detection
• Email security controls
• Anti-malware protections
• Investigation and escalation procedures

Security alerts and identified vulnerabilities are evaluated and prioritized according to risk, severity, potential exposure, and operational impact.

Vulnerability and Patch Management

IGEN maintains documented processes for identifying, evaluating, prioritizing, and remediating known vulnerabilities.

Systems and software are assessed for relevant security weaknesses. Security updates and other remediation activities are prioritized according to documented risk, severity, testing, operational, and contractual requirements.

Where a security update cannot be immediately applied, IGEN may implement compensating safeguards, such as restricting access, disabling affected functionality, increasing monitoring, isolating the system, or removing the affected component from service.

Incident Response

IGEN maintains documented incident-response and escalation processes to support the timely identification, investigation, containment, remediation, and recovery of potential security incidents.

• Initial assessment and classification
• Containment and evidence preservation
• Technical investigation
• Eradication and remediation
• System and service recovery
• Internal escalation
• Client, legal, regulatory, or contractual notification when required
• Post-incident review and corrective actions

IGEN coordinates incident-response activities with appropriate enterprise security, infrastructure, legal, privacy, and business stakeholders.

Business Continuity and Recovery

IGEN maintains documented business-continuity, backup, and disaster-recovery procedures to support the availability and recoverability of applicable services.

• Data backups
• Replication of designated systems and information
• Geographic or infrastructure redundancy
• Documented recovery responsibilities
• Defined recovery requirements based on the service
• Periodic recovery exercises
• Review of recovery procedures and results
• Corrective actions following exercises or events

Recovery objectives, architectures, and commitments may vary by service and are governed by applicable client agreements and service-level commitments.

Risk and Compliance Management

IGEN maintains security policies, standards, procedures, and control activities aligned with the services we provide and the risks associated with those services.

• Periodic risk assessments
• Review of internal controls
• Vulnerability and exposure management
• Security and privacy reviews
• Client security assessments
• Independent assurance examinations
• Policy and procedure maintenance
• Corrective-action tracking
• Periodic reporting to appropriate leadership

IGEN’s security program is supported through collaboration with the U.S. Venture information security and technology organizations.

Service Provider Risk Management

IGEN uses qualified technology and service providers to support certain aspects of its products and operations.

Relevant providers are evaluated according to the nature of the service and the associated security, privacy, availability, operational, and compliance risks. IGEN applies appropriate contractual requirements and oversight based on the provider’s responsibilities and access to systems or information.

Certain IGEN controls also rely on safeguards operated by infrastructure, cloud, hosting, and other service providers. Responsibilities shared among IGEN, its service providers, and its clients are documented as appropriate for the applicable service.

Security Awareness

IGEN personnel receive security and privacy awareness training and are expected to follow applicable information security policies and procedures.

• Phishing and social engineering
• Password and authentication security
• Protection of confidential information
• Safe use of company systems
• Reporting suspected security events
• Privacy responsibilities
• Secure development practices for applicable technical roles

Security awareness is reinforced through periodic communications and other risk-based activities.

Client Responsibilities

Security is a shared responsibility. Clients are expected to protect their own identities, devices, networks, credentials, and administrative settings.

• Maintaining accurate user access and role assignments
• Removing access for individuals who no longer require it
• Protecting passwords and authentication factors
• Using supported and securely configured devices
• Applying appropriate endpoint and network protections
• Promptly notifying IGEN of suspected unauthorized activity
• Securely managing files exported from or transmitted to IGEN services
• Following responsibilities defined in applicable agreements and assurance reports

Requesting Security Information

Qualified clients and prospective clients may request additional security and assurance information through their IGEN business contact.

Available materials may include, subject to confidentiality and appropriate review:

• Current SOC 2 Type 2 reports
• Relevant control descriptions
• Security questionnaire responses
• Business-continuity information
• Architecture or data-flow information appropriate for the engagement
• Additional assurance documentation based on client and contractual requirements

Detailed security documentation, testing results, vulnerability information, and system configurations are not published publicly and are provided only when appropriate.