Information security

1. Our approach

Alin Li runs its own learning platform, servers and student workstations. Our information security policy sets practical controls for all staff, trainers and contractors, and for every device that touches Alin Li systems or data.

The policy is aligned with the controls of ISO/IEC 27001:2022 and with Article 32 of the GDPR. Alin Li is not ISO/IEC 27001 certified; the policy is a practical baseline, not a certificate.

2. Access control

• Strong, unique passwords and multi-factor authentication on systems that support it, especially administrative, email and learning-platform access.
• Least privilege: people receive only the access they need, with administrative accounts kept separate from everyday accounts.
• Access is removed promptly when someone leaves or a contract ends.

3. Secure systems and devices

• Operating systems, platforms and applications are kept up to date, and security updates are applied promptly.
• Work laptops are encrypted and screens lock automatically.
• Remote and administrative access is restricted to approved, secured methods.
• Shared student workstations are locked down and cleaned between sessions, with no personal data left behind.

4. Backups and resilience

Important data is backed up automatically to multiple locations, including a copy held separately from our main systems. We test restoring from backup on a regular schedule, because an untested backup cannot be relied on.

5. Everyday practice

Work data stays in approved Alin Li systems, not personal cloud storage or removable drives. Staff are expected to think before opening links or attachments and to report anything suspicious straight away.

6. Incident response

If an incident is suspected, we contain it, assess the impact, recover from backup and record what to improve. If personal data is affected, we follow our data breach procedure, including notifying the supervisory authority within 72 hours where the law requires it.

To report a security concern, email Info@AlinLi.com.