Last Updated: 19 January 2026

Our Approach to Security

The Parkfield Collective maintains a security-first approach that meets ISO 27001 and SOC 2 standards. Our Security and Compliance Committee oversees all security and compliance efforts across Vellum Group operations.

Governance and Oversight

Executive accountability: Alex Zachman, CEO
Committee: Cross-functional leaders with quarterly reviews
Responsibilities include data protection, vendor security, incident management, and regulatory compliance

Security-First Principles

• Security by Design
• Defense in Depth
• Zero Trust Architecture
• Privacy by Default
• Continuous Validation
• Transparency with Clients
• Incident Preparedness

Compliance Standards

• ISO 27001, SOC 2, ISO 42001 (in progress)
• GDPR, PIPEDA, CCPA/CPRA
• OWASP, NIST, CIS Controls

Security Architecture

Development Security

• SSDLC, threat modeling, static analysis
• Security testing and dependency scanning

Infrastructure

• ISO 27001-certified cloud providers
• DDoS protection, geo-redundancy, automated config mgmt

Integration Security

• Secure APIs, end-to-end encryption, activity logging
• Client environments are fully segregated

Data Protection

• AES-256 at rest, TLS 1.2+ in transit
• Encrypted communications via Proton ecosystem
• Data minimisation, classification, and localisation
• Certified deletion procedures and secure project handoff

Access Control

• MFA and strong passwords for all systems
• RBAC and least-privilege principles
• SSO, session timeouts, audit trails

Operational Security

Vulnerability Management

• Regular scanning, annual pen tests, zero-day mitigation

Change Management

• Change control, rollback, environment separation

Backups & Recovery

• Daily encrypted backups, tested restoration
• Defined RTO/RPO for recovery

Incident Response

• 24/7 coverage, tabletop exercises
• Client notification as required

People Security

• Background checks, annual security training
• Confidentiality agreements and NDAs
• Developer training for secure coding

Vendor Security

• Vendor risk assessments, audit rights, DPAs
• Platform vendor review and best practice enforcement

Client Data Protection

• Segregated environments, retention policies
• Deletion and audit rights
• Clients maintain data ownership

Compliance and Auditing

• Internal and external security audits
• Annual penetration tests
• Documented controls and security logs

Business Continuity & Disaster Recovery

• Continuity plans, redundant systems, defined recovery objectives
• Stakeholder communication and client continuity support

Client-Specific Security

• Pre-project security reviews and custom controls
• Secure handoffs, milestone reviews, platform-specific implementation security

Security Documentation Access

Clients may request:

• Technical security specs
• Questionnaire responses
• Certifications and audit summaries
• Insurance certificates

Contact Information

Security: security@parkfieldcollective.com
DPO: privacy@parkfieldcollective.com
Incidents: security-incident@parkfieldcollective.com

The Parkfield Collective
    c/o Vellum Technologies Ltd
    Pollexfen House, Wine Street
    Sligo, F91 A3FD
    Ireland