Purpose
This policy establishes the framework for managing information security across Carriyo. It defines our commitment to protecting the confidentiality, integrity, and availability of all information assets belonging to Carriyo, our customers, and our partners.
Scope
This policy applies to all Carriyo employees, contractors, partners, and third-party service providers who access Carriyo information systems or data.
Key Commitments
Confidentiality
We ensure that information is accessible only to those authorized to have access. All customer shipment data, order data, and personally identifiable information (PII) is treated as confidential by default.
Integrity
We safeguard the accuracy and completeness of information and processing methods. Data validation, checksums, and audit logging ensure that information is not altered without authorization.
Availability
We ensure that authorized users have access to information and associated assets when required. Our infrastructure is designed with redundancy and failover capabilities to maintain our 99.90% uptime availability commitment. Achieved availability is tracked annually against this commitment and recorded at the management review (CAR-ISMS-REC-021).
Authoritative availability commitment. CAR-ISMS-POL-001 is the single authoritative source for Carriyo's platform availability/uptime commitment. The committed target is 99.90%. Achieved availability is tracked annually against this commitment and recorded at the management review (CAR-ISMS-REC-021); it shall not be confused with the commitment figure. All other ISMS documents, customer-facing materials, and trust-center content shall reference this figure from POL-001 rather than independently restating it; any change to the availability commitment shall be made here first and then reconciled across downstream documents.
Information Classification
Carriyo classifies information into four categories:
- Public — Marketing materials, public documentation, blog posts
- Internal — Internal procedures, non-sensitive business information
- Confidential — Customer data, financial records, employee data
- Restricted — Encryption keys, authentication credentials, security configurations
Management Responsibility
Carriyo's leadership is committed to information security and demonstrates this through:
- Allocating adequate resources for information security initiatives
- Conducting annual management reviews of the ISMS
- Ensuring security roles and responsibilities are clearly defined
- Supporting continuous improvement of security controls
Compliance
This policy is reviewed annually or upon significant changes to Carriyo's operations, technology, or threat landscape. All employees receive annual security awareness training covering this policy and related procedures.
Enforcement
Violations of this policy may result in disciplinary action, up to and including termination of employment or contract, and may also result in legal action where applicable.