Security Overview

Puffyn · Version 1.0 · 27 August 2026

1. Purpose and status

This document describes the technical and organisational security measures in place at Puffyn. It serves three functions:

• it is the Security Policy referenced in the Agreement;
• it constitutes Annex II (Technical and Organisational Security Measures) to the DPA, including for the purposes of the EEA SCCs and the UK Addendum incorporated into it; and
• it is Puffyn's standing response to customer security due diligence enquiries.

It describes measures in place as at the version date. It does not describe planned or intended measures.

Puffyn may update this document from time to time, provided that no update materially diminishes the overall level of protection described. The current version is the one published at this address; earlier versions are recorded in the version history at the end.

2. Definitions

Terms used in this document that are defined in the Agreement or the DPA — including Customer, Customer Data, Customer Personal Data, Cloud Service, Professional Services, Authorised User and Sub-processor — have the meaning given there. A Customer may request a copy of either document at the address in section 3.

The following terms are used in this document only.

3. Contact

Security enquiries, vulnerability reports, due diligence requests and data protection enquiries, including data subject requests: security@puffyn.co.

The Security Owner is Owen Riddall, Director. The Data Protection Lead is Owen Riddall, Director. Puffyn has not appointed a Data Protection Officer under Article 37 of the UK GDPR, having assessed that it is not required to do so.

4. Scope

4.1 What Puffyn provides

Puffyn provides the Cloud Service — hosted financial scenario analysis software — and Professional Services, being AI and technology consulting. Each is described in the applicable Order Form.

For the Cloud Service, Customer Data consists principally of fund, portfolio, facility and transaction modelling inputs and the outputs generated from them, held in the infrastructure described at section 4.2. The categories of personal data Puffyn processes on a Customer's behalf are set out in the DPA.

For Professional Services, the data Puffyn handles is determined by the engagement, and is generally held in Puffyn's corporate systems rather than in the Cloud Service infrastructure. The measures in section 5 apply to Puffyn's corporate systems as well as to the Cloud Service, except where stated to apply to the Cloud Service specifically.

Puffyn is a small organisation, and the measures described are proportionate to its size.

4.2 Infrastructure and sub-processors

Puffyn operates no data centres, servers or network hardware. The Cloud Service runs on third-party infrastructure, and Puffyn uses third-party corporate systems that may hold Customer information incidental to operating the business.

Sub-processors are engaged for both the Cloud Service and Professional Services, and each is engaged under a data processing agreement. The current list is published at puffyn.co/subprocessors, with its own version history, and identifies which line each sub-processor supports.

4.3 AI Tools

Puffyn uses third-party AI Tools as efficiency tools in its own operational work. No AI Tool is embedded in the Cloud Service, generates any part of its outputs, or is relied on to deliver it.

Where an AI Tool processes Customer Personal Data, the provider is engaged as a sub-processor under a data processing agreement and is identified on the list published at the address given at section 4.2. Puffyn engages AI Tools only on terms that do not permit the provider to use submitted content to train its models.

Customer Data, including Customer Personal Data, may be included in submissions where necessary for the work being performed — principally when diagnosing a defect involving a specific Customer's data, and on Professional Services engagements. Puffyn limits such use to what the task requires. Material that a Customer may not submit to Puffyn under its Agreement, including Special Category Data, is not submitted to an AI Tool.

4.4 International transfers

Where a Vendor or corporate system processes personal data outside the United Kingdom or EEA, transfers are made on the basis set out in the DPA.

5. Technical and organisational measures

5.1 Pseudonymisation and encryption

Puffyn does not apply pseudonymisation to Customer Data; the Cloud Service requires modelling inputs and outputs in their original form. Authorised User credentials are held by the Authentication Service and stored only as cryptographic hashes; Puffyn's application code does not handle credentials.

5.2 Confidentiality, integrity, availability and resilience

Each Customer is provisioned with a separate application deployment and a separate database. Each deployment holds credentials for that Customer's database and authentication tenant only, and cannot reach another Customer's data. No Customer Data is held in tables shared between Customers.

Isolation is logical rather than physical: Customer databases and applications run on shared managed infrastructure operated by the relevant Vendors.

Database credentials are held as environment variables scoped to each deployment and accessible only to server-side functions. They are not exposed to browser-side code. Puffyn's own credentials and secrets are held in a password manager with multi-factor authentication enabled.

Network exposure is minimised. The hosting provider exposes only HTTPS at the edge and manages port configuration; database access is restricted to encrypted connections presenting a deployment-scoped connection string. Puffyn operates no network hardware of its own.

The Cloud Service is built on managed infrastructure operating with redundancy across multiple availability zones.

5.3 Restoration of availability and access following an incident

Application infrastructure is defined in code and held under version control. The application can be redeployed from source without manual reconstruction of the environment.

Customer databases are hosted on a managed Postgres service providing point-in-time restore.

5.4 Testing, assessment and evaluation of measures

All changes to application code are reviewed by a second engineer before merge. An automated test suite runs against each change.

No independent penetration test or third-party security assessment has been performed to date. No automated dynamic or static application security testing is in place, and automated dependency vulnerability alerting is not enabled on Puffyn's application repositories.

Identified vulnerabilities are triaged on discovery and prioritised by severity and exploitability.

5.5 User identification and authorisation

Authentication is performed by the Authentication Service. On successful authentication a signed token is issued, which Puffyn's backend validates before any database access is performed.

Role-based access control. Authorised Users are assigned owner, administrator or member roles. Roles determine whether a user may view other users in their organisation, invite users, change roles, remove users, change organisation settings, set multi-factor authentication requirements, and configure enterprise single sign-on. Roles do not currently differentiate access to modelling functionality or data within a Customer's tenancy: all Authorised Users in a tenancy can access that tenancy's data.

Multi-factor authentication is available to Authorised Users. Organisation-wide enforcement of multi-factor authentication, SAML and OIDC single sign-on, and SCIM user provisioning are available as enterprise upgrades.

Puffyn personnel access. Administrative access to production systems is restricted to Puffyn's engineering team. Within that team it is not segmented further: least-privilege segmentation between roles is not applied at current size. Access is via individual named accounts where the provider supports them; a small number of provider owner accounts are held under shared credentials in the password manager with multi-factor authentication enabled.

5.6 Protection of data in transit

All connections to the Cloud Service use TLS 1.2 or TLS 1.3. HTTPS is enforced at the hosting layer, with certificates provisioned and renewed automatically. Connections between application functions and the database, and to object storage, use TLS.

5.7 Protection of data at rest

Customer Data held in the database and in object storage is encrypted at rest using AES-256 with provider-managed keys. Puffyn does not offer customer-managed or customer-supplied encryption keys.

5.8 Physical security

Puffyn operates no data centre, server or network hardware. Physical and environmental security for the systems processing Customer Data is therefore provided entirely by the infrastructure providers described at section 4.2 and the cloud infrastructure on which they operate. Puffyn relies on those providers' security programmes and published assurance reports; it does not conduct physical inspections of their facilities and does not present their controls as its own.

Puffyn personnel work on individually owned devices. Devices used to access Customer Data are encrypted at rest and require authentication to unlock. Puffyn does not operate mobile device management or centrally enforce device configuration.

5.9 Event logging

Logging is provided by the Vendors that operate the Cloud Service infrastructure:

• the hosting provider records request and function logs, including request metadata, route, response status and user identifier;
• the database provider records availability, connection, resource utilisation and query performance data;
• the Authentication Service records authentication events, including sign-in attempts.

Logs are retained for the periods provided by the relevant Vendor. The Cloud Service does not currently maintain an independent application-level audit trail of user actions within the product. Puffyn does not currently operate centralised log aggregation, log retention beyond that of its Vendors, or automated alerting on security events.

5.10 Systems configuration

Infrastructure is defined in code and version-controlled. Each Customer has a dedicated application deployment. Each change creates a preview environment before promotion to production. Previous deployments are retained and can be reinstated.

Development and testing are normally performed against data that does not contain Customer production data. Where diagnosis of a specific issue requires it, a copy of a Customer's production data may be connected to a non-production environment. Such access is limited to the personnel handling the issue, and the copy is removed once the issue is resolved.

5.11 Internal governance of information security

Accountability for information security is assigned to the Security Owner. Puffyn maintains an internal information security management system comprising documented policies and supporting registers, including a vendor and risk register, an access review log and an incident log. It includes an incident management policy covering detection and classification, containment and investigation, escalation, notification of affected Customers, and post-incident review. Puffyn's incident notification obligations to Customers are set out in the DPA.

Vendors are assessed at onboarding for available third-party security assurance and, where the Vendor will process personal data, for the existence of a data processing agreement.

Puffyn does not currently perform pre-employment background screening, and does not currently operate a formal security awareness training programme.

5.12 Certification

Puffyn does not hold any formal security certification or attestation.

5.13 Data minimisation

Puffyn collects the account information necessary to provide the Cloud Service and to contact Authorised Users about it. Modelling data held in the Cloud Service is that which the Customer chooses to enter or upload. Puffyn does not use Customer Data for advertising or profiling, and does not sell Customer Data. Uses of Customer Data beyond providing the Cloud Service are limited to those described in this document and permitted by the Agreement.

5.14 Data quality

Customers control the accuracy and currency of the data they enter. Puffyn records the version of the calculation code associated with generated outputs, and makes intermediate calculation values available within the Cloud Service so that results can be traced through to their inputs.

5.15 Limited retention

For active Customers, production data is retained for the duration of the Agreement.

On termination, Customer Data is deleted in accordance with the Agreement. Backups and database change history age out automatically at the end of the applicable retention window; Puffyn does not restore or access a terminated Customer's data from backups or history except where required by law.

Correspondence with a Customer held in Puffyn's corporate systems is retained in accordance with Puffyn's internal retention practice and deleted on request insofar as Puffyn is not required to retain it.

Data in the Cloud Service is scoped to the Customer organisation, not to individual Authorised Users. Removing an Authorised User revokes that user's access; it does not delete Customer Data, which remains available to the Customer.

5.16 Accountability

Puffyn acts as processor in respect of Customer Data and as controller in respect of its own business records. Processing is governed by the DPA, which incorporates the EEA SCCs and UK Addendum where applicable. Accountability for information security sits with the Security Owner and for data protection with the Data Protection Lead.

5.17 Data portability and erasure

On request, Puffyn will provide a Customer with a complete PostgreSQL dump of that Customer's database.

Puffyn will delete Customer Data on request, and will assist a Customer in responding to data subject requests for access, rectification, erasure, restriction or portability, in accordance with the DPA.

6. Version history