This Policy should be read alongside our Privacy Policy, Cookie Policy, Safeguarding & Online Safety Policy, and GDPR Compliance Policy. Those policies state what data we hold and why; this Policy states how we protect it technically and what we do if something goes wrong.

1. Policy Statement

Thoughtful Insight depends on technology to deliver courses, manage learner accounts, and store personal and organisational data.

That dependence creates risk: security breaches can arise from human error, malicious attacks (such as ransomware, phishing, or denial-of-service attacks), or system failure.

Any of these could damage our reputation and finances, disrupt learners’ access to their courses and records, and — where a safeguarding disclosure or sensitive learner information is involved — put people at real risk.

This Policy sets out the technical and organisational measures we use to reduce that risk, and the recovery plan (“playbook”) we follow if a significant incident occurs, so that we can restore access to our data and keep the Platform running.

2. Scope

This Policy applies to:

• All Thoughtful Insight employees, contractors and third-party partners with access to our systems.

• All instructors and content creators using platform tools.

• The Platform’s infrastructure, including our website, learning management system (LMS), and connected third-party services.

• All devices — company-issued or personal — used to access Thoughtful Insight systems or data.

It does not replace our Privacy Policy (what data we collect and why) or our Safeguarding & Online Safety Policy (how we respond to conduct and welfare concerns) — see those documents for those topics.

3. What Counts as Confidential or Sensitive Data

Confidential data is information that is valuable, restricted, or would cause harm if exposed.

On our Platform, this includes:

• Personal Data — names, contact details, dates of birth, and other Identity/Contact Data as defined in our Privacy Policy.

• Financial Data — payment card details, bank details, invoicing information.

• Credentials — usernames, passwords, API keys, and session tokens used to authenticate access to our systems.

• Learning Data — course progress, assessment results, and certification records, particularly where these are relied on by an employer for compliance purposes.

• Safeguarding Records — any disclosure or concern logged under our Safeguarding & Online Safety Policy; this category carries the highest sensitivity, as exposure could put a vulnerable individual at further risk.

• Business-Confidential Information — course content and intellectual property, supplier contracts, and internal system architecture details.

4. Examples of Resources That Could Be Attacked

To make the risk concrete, examples of the assets a cyber-attack could target include:

5. How We Store and Protect Data

• Encryption — Personal Data is encrypted in transit (e.g. HTTPS/TLS) and, where appropriate, at rest.

• Access Controls — Access to systems and data is granted on a need-to-know basis and reviewed periodically; former employees’ and contractors’ access is revoked promptly on departure.

• Password and Authentication Standards — Strong, unique passwords are required for all systems; multi-factor authentication (MFA) is enabled for accounts with access to personal or financial data, and for all administrator-level accounts.

• Network Security — Firewalls, intrusion detection, and network segmentation are used to limit how far an attacker can move if one system is compromised.

• Patching and Updates — Software, operating systems and plug-ins are kept up to date, with critical security patches applied promptly.

• Backups — Regular, encrypted backups are taken and stored separately from live systems (including offline or immutable copies) so that a ransomware attack on live systems cannot also destroy our recovery point.

• Device Security — Company-issued devices use up-to-date antivirus/anti-malware protection and disk encryption; personal devices used to access Thoughtful Insight systems must meet the same minimum standard.

• Third-Party Due Diligence — Suppliers with access to our data (LMS providers, payment processors, analytics tools) are assessed for their own security standards before onboarding, and bound contractually to protect the data we share with them.

6. Protecting Users Online

Because learners interact with the Platform directly — including via forums, messaging, and course submissions — we take the following steps to protect them while online:

• Secure Login — Session timeouts, account lockout after repeated failed login attempts, and encrypted credential storage.

• Safe Content Delivery — Embedded third-party content (videos, quizzes, SCORM/xAPI modules) is sourced only from vetted providers to reduce the risk of malicious embedded code.

• Phishing Awareness for Learners — We will never ask learners for their password by email; learners are advised to verify any email claiming to be from Thoughtful Insight before clicking links or entering credentials.

• Reporting Tools — The same in-platform “Report” feature used for safeguarding concerns (see our Safeguarding & Online Safety Policy) can be used to flag suspicious messages, content, or accounts.

7. Email and Phishing: Guidance for Employees

Email is one of the most common ways malicious software and scams reach an organisation.

Attackers may send messages designed to trick a user into revealing login credentials (phishing), or specifically target senior staff with tailored, convincing messages (whaling). These messages often contain links or attachments — such as documents or spreadsheets — that appear legitimate until clicked.

To reduce this risk, employees are required to:

• Verify the sender’s actual email address, not just the display name, before acting on a request involving payment, credentials, or sensitive data.

• Avoid clicking links or opening attachments from unexpected or unverified senders, even if the message appears to come from a colleague or known organisation.

• Hover over links to check the destination URL before clicking.

• Never enter a Thoughtful Insight username or password into a page reached via an email link — go to the Platform directly instead.

• Report suspected phishing emails immediately to security@thoughtfulinsight.uk rather than forwarding, replying to, or deleting them.

• Treat urgent or pressuring requests (e.g. “act now,” “confidential,” requests to bypass normal approval steps) as a warning sign, not a reason to move faster.

8. Roles and Responsibilities

9. Incident Response Playbook

If we suspect or confirm a significant cyber security incident (e.g. ransomware, unauthorised access, or a denial-of-service attack), we follow these steps:

1. Contain

Isolate affected systems to stop the incident spreading (e.g. disconnecting affected devices from the network).

2. Assess

The Security Lead assesses the scope: what systems, data, and users are affected.

3. Notify Internally

Leadership and relevant staff are informed so business continuity decisions can be made.

4. Notify Externally, Where Required

If Personal Data is affected, we assess our obligation to notify the ICO within 72 hours and affected individuals without undue delay, per our Privacy Policy.

If the incident overlaps with a safeguarding concern, our Safeguarding & Online Safety Policy’s escalation route runs in parallel, not instead of, this process.

5. Recover

Restore systems from clean backups, and confirm systems are secure before bringing them back online.

6. Review

Conduct a post-incident review to identify what allowed the incident to happen and update controls accordingly.

Maintaining continuity of business — including learners’ ability to access courses and certification records — is a priority throughout recovery, alongside containing the incident itself.

10. Training

All employees and instructors complete mandatory security awareness training, including how to recognise phishing attempts and respond to suspected incidents.

Training is refreshed periodically to reflect new and emerging threats.

11. Reporting a Concern

• Suspected phishing, malware, or security incident: Report immediately to security@thoughtfulinsight.uk — do not wait to confirm it’s genuine.

• Data breach involving Personal Data: Handled under this Policy’s Section 9 and our Privacy Policy’s breach process.

• Safeguarding concern arising from online contact: Report via the Platform’s “Report” feature or safeguarding@thoughtfulinsight.uk per our Safeguarding & Online Safety Policy — this is a different route from a security incident report, even where the two overlap (e.g. an account compromise used to contact a learner inappropriately).

12. Policy Governance and Review

This Policy is reviewed at least annually, and following any significant security incident, to reflect evolving threats, technology, and regulatory requirements.

• Effective Date: August 2026

• Next Review Date: August 2027