Physical and environmental security policy

Production hardware#

1. In-scope production runs in facilities operated by a subservice organization with its own SOC 2 Type II or ISO 27001 report covering physical access, environmental protection (power, cooling, fire, flood), and hardware disposal ACC-15, AVL-06. Rang & Mall does not operate in-scope production hardware in an office or a residence.
2. The provider's report is reviewed yearly under 22 and the review notes any exception related to physical or environmental controls.
3. If production ever runs on hardware Rang & Mall owns, it is in a colocation facility meeting point 1, with dedicated hardware, encrypted disks, and an access list kept by the facility.

Offices and remote work#

1. Development machines and laptops are protected by the endpoint baseline in 11: disk encryption, screen lock, updates.
2. Screens showing customer data are not visible to visitors or in public places.
3. Paper with customer data is not printed except where a customer process requires it, and is shredded after use.
4. Visitors to an office where development machines are kept are accompanied.

Equipment off-site and disposal#

Devices taken off-site are under the owner's control at all times. Disposal follows 14.