POL-SEC-001
Credentials, security, and ownership of digital resources
The client retains control over accounts it owns. LBS will request delegated permissions when available and will avoid sharing passwords through insecure channels.
- Document
- POL-SEC-001
- Version
- 1.0
- Status
- In force
- Effective
- October 1, 2026
- Updated
- October 20, 2026
- Category
- Data & general terms
1. Access management
The client retains control over accounts it owns. LBS will request delegated permissions when available and will avoid sharing passwords through insecure channels.
2. Credential handover
At project completion, credentials belonging to the client will be delivered or confirmed through a secure method. Changing temporary passwords and enabling multifactor authentication is recommended.
3. Unauthorized changes
Staff will not be allowed to access accounts outside granted permissions. The client shall promptly communicate access revocations or incidents.
4. Incidents
When a security issue affecting information or services is detected, LBS will investigate, mitigate as reasonably possible, document actions, and make the communications required by law and applicable agreements.
5. Third-party resources
Licenses, APIs, domain names, and subscriptions may belong to the client, LBS, or providers. Each proposal must state ownership and continuity terms.