Data Processing & Security Statement

TD Watts Consulting, LLC ("TD Watts") is committed to protecting the confidentiality, integrity, and availability of data we process on behalf of our clients. This Data Processing & Security Statement describes the technical and organizational measures we implement to safeguard data.

1. Data Processing Scope

We process client data solely for the purpose of delivering professional consulting services as defined in our engagement agreements. The categories of data, processing purposes, and duration are specified in each client's agreement and our Privacy Policy.

2. Technical Security Measures

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of data at rest where sensitive information is stored.
• Regular vulnerability scanning and penetration testing.
• Firewall and intrusion detection/prevention systems.
• Secure software development lifecycle practices.
• Regular security patching and system updates.

3. Organizational Security Measures

• Role-based access control with the principle of least privilege.
• Multi-factor authentication for all administrative and sensitive system access.
• Comprehensive security awareness training for all personnel.
• Background checks for personnel handling sensitive data.
• Documented security policies reviewed annually.
• Signed confidentiality agreements with all employees and contractors.

4. Access Controls

Access to client data is restricted to authorized personnel who require access to perform their job functions. Access rights are provisioned, reviewed, and revoked through a formal access management process. All access events to sensitive systems are logged and monitored.

5. Incident Response

We maintain an incident response plan that defines roles, responsibilities, and procedures for detecting, assessing, containing, and remediating security incidents. In the event of a data breach affecting client data, we will notify affected clients without undue delay in accordance with applicable contractual and legal requirements.

6. Sub-processor Management

We engage sub-processors only under written agreements that impose data protection obligations equivalent to those in this statement. We maintain a list of sub-processors and notify clients of material changes. Clients may object to new sub-processors as provided in their agreements.

7. Business Continuity

We maintain business continuity and disaster recovery plans to ensure operational resilience. Critical systems are backed up regularly, and recovery procedures are tested periodically to ensure effectiveness.

8. Compliance and Audits

We align our security practices with industry frameworks including NIST Cybersecurity Framework. We undergo periodic security assessments and make relevant documentation available to clients under appropriate confidentiality agreements. For security inquiries, email security@tdwatts.com.