Start your security review.

Wolf IQ maintains a written Information Security Policy covering governance, access, data handling, change management, resilience and incident response. It is aligned with our Terms and Conditions, Privacy Policy and the commitments we make in vendor risk assessments. The current approved version is available on request.

The policy is reviewed and endorsed annually, and again after any material change to our technical environment or business operations. Version and effective date are recorded on the document itself.

Information security is managed internally by our technical team. Each client environment has a named internal owner responsible for access management and service delivery, and infrastructure-level security and monitoring sits with our hosting provider.

All employees and contractors complete information security and data privacy awareness training during onboarding and on an ongoing basis. Acceptable use requirements and data handling protocols are set as a condition of engagement.

Every employee and contractor is bound by confidentiality and acceptable use agreements before they are given access to any client environment.

All personnel undergo identity verification and professional due diligence prior to engagement. Formal background checks are mandatory for anyone granted privileged administrative access to production environments or sensitive data.

Access to client environments, hosting dashboards and sensitive data is granted through individually attributable accounts. Role-based access controls determine what each person can do in each system.

Access is granted strictly on a need-to-know basis and limited to what the role requires. Elevated permissions are the exception, not the default.

MFA is required for all Wolf IQ personnel accessing critical infrastructure, password managers and client production environments. Strong password policies are enforced on privileged and non-privileged accounts alike.

Access rights are reviewed on a recurring basis to confirm that every account still needs the permissions it holds. Anything no longer required is removed at the point of review.

On role change, offboarding or contract termination, all system access is revoked immediately. A formal review follows to confirm the ongoing integrity of every affected environment.

All remote access to client systems runs over encrypted connections using HTTPS with TLS 1.2 or 1.3. There is no unencrypted administrative access path.

Access is restricted to authorised personnel located in Australia and the Philippines, unless a client approves an additional location in writing.

Where a client requires it, access can be restricted to pre-approved static IP addresses to support their own allowlisting controls.

Information assets are identified during onboarding and are generally limited to website data, CMS databases and associated media. Assets are classified as public or sensitive, and where a client supplies their own classification we apply controls to match it.

All data in transit is encrypted using TLS 1.2 or 1.3 over HTTPS, across both client-facing traffic and administrative access.

Encryption at rest is managed by our hosting provider on Google Cloud Platform using cloud provider-managed encryption standards. Key management sits with the hosting provider.

Client data is retained only for as long as required to deliver contracted services and meet legal obligations. On termination, associated client data including backups is securely destroyed. Automated daily backups are retained for up to 90 days.

Application logs are reviewed during incidents and troubleshooting. Infrastructure and security event logs are retained for a minimum of 90 days by our hosting provider, and access to audit and event logs is limited to authorised personnel.

Payment card information is never stored in the WordPress environments we manage. Payment processing runs exclusively through third-party gateways, so sensitive financial data is not held at the application layer.

Our internal workflows are aligned with the Australian Privacy Act and the Notifiable Data Breaches scheme. Mandatory regulatory notification obligations remain with the client as the data holder.

Every managed client website runs separate development, staging and production environments. Nothing is edited directly against production as a matter of course.

All WordPress updates, fixes and enhancements follow a structured change process. Changes are tracked in our internal task management system and reviewed and approved internally before implementation.

Changes are tested in a staging environment before deployment. Non-critical updates are batched into scheduled maintenance windows rather than pushed ad hoc.

Rollback capability is maintained through version control and backup restoration, so a change that causes a problem can be reversed rather than patched under pressure.

All software in use, including WordPress core, premium plugins and development tools, is legally licensed and maintained under an automated update policy.

Application-level vulnerabilities are monitored continuously through automated scanning. Infrastructure-level scanning is handled by our hosting provider.

Critical vulnerabilities are patched immediately on identification rather than held for the next maintenance window.

Wolf IQ conducts periodic application security reviews as part of WordPress maintenance. Our hosting provider runs regular infrastructure penetration testing, and we can support formal third-party penetration testing arranged by a client on request.

Managed sites run on Kinsta, which operates on Google Cloud Platform. Kinsta holds independent SOC 2 Type II and ISO 27001 certification covering that infrastructure.

Client data is logically segregated using isolated container-based hosting environments, so an incident affecting one client environment does not spread to others.

Infrastructure-level controls include web application firewalls and DDoS mitigation, applied across all managed environments.

Where applicable, Cloudflare is deployed for DNS-level protection, DDoS mitigation and traffic filtering on top of the hosting layer.

Network traffic is monitored continuously at the infrastructure layer by our hosting provider, with alerting into their security operations.

Automated daily backups of all managed websites run through both BlogVault and Kinsta. Backup jobs are actively monitored and failures are investigated and resolved.

Backups are stored off-site on Google Cloud and retained for up to 90 days, giving a recovery window well beyond a single bad deployment.

Periodic restoration testing is carried out to confirm that backups restore cleanly, rather than assuming a successful backup job means a usable backup.

Recovery Time Objective is 2 to 4 business hours during standard operating hours. Recovery Point Objective is 24 hours, based on the daily backup cycle. Both are supported by infrastructure-level redundancy and high availability.

On detection of a critical incident we lock down and contain the affected system, investigate root cause and scope, remove malicious code, remediate the vulnerability, and restore the site to its most recent clean state.

We notify the affected client of a confirmed material security breach no later than 48 hours after becoming aware of it, including the nature of the breach and the mitigation steps taken.

Every critical incident closes with a written post-incident summary to the affected client, covering what happened and what changed as a result.

If an incident at a third-party provider affects services we deliver, we notify the affected client as soon as reasonably possible based on the information available to us.

Affected clients are notified of service disruptions and kept updated while we investigate and resolve, in line with agreed service levels.

Third-party providers are selected on security posture and operational track record, and are governed by their respective agreements. Where required, clients are informed of providers and approval is obtained during onboarding.