Imperial Eminence Cyberguard Corporation · The Ivory Index
Information Security Program
Tier V — Security Program · Ref: IECC-T5-001 · Version 1.0 · Effective 14 June 2026
This Information Security Program ("Program") establishes IECC's overarching framework for protecting the confidentiality, integrity, and availability of information assets — including Customer data, proprietary software, and operational systems. It is distinct from the Security Whitepaper (technical architecture) and the Security Addendum (contractual security commitments).
| Role | Responsibility |
|---|---|
| Security Owner | Overall accountability for the Program; approves policy changes; escalation point for P1 incidents |
| Technical Lead | Day-to-day implementation of security controls; vulnerability management; access reviews |
| All Personnel | Compliance with this Program; reporting of suspected incidents or policy violations |
Until IECC reaches a headcount requiring a dedicated CISO, the Security Owner role is fulfilled by the founding technical lead. Security responsibilities will be formally delegated upon organisational scaling.
| Asset Category | Examples | Classification | Owner |
|---|---|---|---|
| Source code | Ivory Index application, build scripts | Confidential | Technical Lead |
| Customer data (cloud) | Support tickets, account data | Restricted | Security Owner |
| User local data | Profiles at ~/.theivorry/ (on User devices) | N/A — not held by IECC | User |
| AI model weights | llama3.2, Ollama models | Third-party — governed by model licences | Technical Lead |
| Infrastructure credentials | Cloud provider keys, signing certificates | Restricted | Security Owner |
| Legal and financial records | Contracts, invoices, correspondence | Confidential | Security Owner |
| Brand assets | Logos, marketing materials | Internal | Founding team |
IECC conducts an annual information security risk assessment covering: threat identification; vulnerability assessment; likelihood and impact scoring; risk treatment decisions (accept, mitigate, transfer, avoid); and residual risk acceptance.
| Risk | Likelihood | Impact | Treatment |
|---|---|---|---|
| Local device compromise leaking User data | Medium | High | Mitigate: recommend FDE; User responsibility disclosure |
| Supply chain attack on npm dependencies | Low–Medium | High | Mitigate: dependency scanning; lock-file integrity |
| Credential theft (IECC internal systems) | Low | High | Mitigate: MFA; least privilege; regular rotation |
| AI model generating harmful output | Medium | Medium | Mitigate: AUP; AI disclaimer; User review obligation |
| Malicious Ollama model distribution | Low | High | Mitigate: official registry only; User model selection control |
| Electron XSS-to-RCE escalation | Low | Critical | Mitigate: context isolation; node integration disabled; CSP |
| Severity | CVSS Score | Patch Timeline |
|---|---|---|
| Critical | 9.0–10.0 | 7 days |
| High | 7.0–8.9 | 30 days |
| Medium | 4.0–6.9 | 90 days |
| Low | 0.1–3.9 | Next scheduled release |
Vulnerability sources include: automated dependency scanning (each release); external researcher reports via legal@imperialecc.com; CVE databases; and threat intelligence feeds.
All IECC personnel with access to Restricted or Confidential assets receive security awareness training upon onboarding and annually thereafter. Training covers: phishing recognition; password security; incident reporting; data handling; and acceptable use of IECC systems.
This Program is reviewed and updated annually, upon material organisational change, or following any P1 or P2 security incident. All updates are approved by the Security Owner and versioned. Contact: legal@imperialecc.com.
