Skip to main content

Information Security Policy

  • Company: draw.io Ltd
  • Owner: David Benson
  • Version: 1.4
  • Published: 3 October 2026

Background Information​

draw.io Ltd develops draw.io, the world’s most widely used browser-based end-user diagramming application.

draw.io Ltd aims to provide free, high quality diagramming software for everyone.

Purpose​

This policy defines the requirements for protecting draw.io Ltd information assets and systems, including physical and digital forms, throughout their lifecycle, to support our people, our customers and processes with a standard approach to managing and addressing information security related threats and events at draw.io Ltd.

Goals​

  • Define a simple and structured baseline of security controls to which draw.io Ltd adheres.

Scope​

This policy applies to all personnel, including contractors, of draw.io Ltd and all activities relating to the use, handling, management or control of information assets and systems controlled by draw.io Ltd.

Roles and Responsibilities​

Roles and responsibilities of personnel at draw.io Ltd are proactively identified and assessed, in alignment with the business requirements and information security best practices.

  • Personnel of draw.io Ltd follow and operate within all relevant regulations, standards, and legislation, including this standard to ensure the safeguarding of draw.io Ltd information assets.
  • Report any detected or suspected deviation from this information security standard to the designated Information Security Manager.

Access Control​

Access to information assets and systems by personnel of draw.io Ltd is proactively identified, managed, and assessed in alignment with applying the principle of least privilege and need to know basis.

  • Develop, implement and maintain an access control procedure for information assets and systems where access to those information assets and systems presents a material risk.
  • Protect draw.io Ltd information assets and systems in accordance with the defined access control procedure.
  • Identify and provide unique credential sets for each personnel requiring access to draw.io Ltd information assets.
  • Develop, implement and maintain a strong credentials in the form of one or more of the following:
    • Complex passwords (12+ characters consisting of upper, lower, numeric, and special characters).
    • Biometrics (fingerprint, iris, face, voice)
    • Tokens (soft - Microsoft Authenticator, Google Authenticator, OTP / TOTP, hard - RSA SecurID, Yubikeys)

Human Resources​

Risks associated with employment of personnel of draw.io Ltd are proactively identified and assessed in alignment with ISO/IEC 27001:2013 Annex A, A.7 Human resource security.

  • Conduct and complete background verification checks for all personnel prior to the commencement of employment.
  • Define, develop and enrol all personnel in the security awareness and training program.
  • Define and document metrics for measuring the success of the security awareness and training program.
  • Assess and evaluate the success factors of the security awareness and training program.

Information Management​

Operational activities associated with the handling of information are performed in accordance with draw.io Ltd policies and procedures.

  • Classify and handle information as defined by the information classification and handling policy and data stewardship and governance policy.

Information Assets​

Information assets and systems are identified, recorded and routinely assessed to ensure appropriate classification labels have been assigned in an information asset register.

  • Define, document and assign an owner of information assets and systems.
  • Define, document and assign a classification label to information assets in accordance with the information classification and handling policy.
  • Maintain and update information assets and systems and their security in accordance with this policy.

Cryptography and Encryption​

Implementation of cryptography and encryption is controlled to protect information assets and systems.

  • Use encryption and cryptography technology that is currently considered strong by industry standards.
  • Enable full disk encryption on all company endpoint devices. FileVault is enabled on all draw.io Ltd devices.
  • Encrypt and protect all authentication and authorisation communications.
  • Identify, protect and encrypt all personally identifiable information at rest and in transit.
  • Identify, review and analyse infrastructure configurations and policies to determine appropriate strong encryption requirements are implemented.
    • Example 1: SMTP should require TLS for communications for each mail relay used and refuse delivery where TLS is not available.

Operations​

Operational processes and activities are delivered and reviewed for conformance with information security practices.

  • Operational processes are updated in accordance with the reviews for the achievement of a good information security programme.
  • Define, document and maintain information security aspects of operational processes and procedures undertaken as business-as-usual activities.
  • Employ verification of information security controls and approaches to all items impacting information assets and systems through the change management process.
  • Define, document and maintain appropriate processes for the monitoring of networked assets to ensure threats are identified.
  • Adhere to the Endpoint Security Policy.

Communications​

Communication of information assets is performed in a secure and safe manner to ensure compliance with the information classification and handling policy.

  • Protect information assets prior to and during transit using encryption and cryptographic controls in accordance with the information classification and handling policy.

System Acquisition and Development​

The potential dangers of implementing and utilising systems without appropriate information security controls applied are proactively detected and analysed to align with the risk framework.

  • Define, document and maintain a systems development lifecycle which implements information security practices within each phase.
  • Apply and comply with the required steps as defined within the systems development lifecycle.

Supplier and Third-Party Relationships​

Suppliers and third-party entities which draw.io Ltd works with and obtains services from are routinely assessed and reviewed for good information security practices to ensure alignment with acceptable information security practices.

  • Adhere to the Third Party Management Policy.

Incident Management​

The potential dangers of information security incidents and associated events that impact draw.io Ltd or its stakeholders are proactively identified, managed and treated in order to protect draw.io Ltd, its people and stakeholders.

  • Define, document and implement measures to identify and alert on suspected or actual information security events.
  • Report suspected and actual information security incidents to the designated information security manager.
  • Triage and implement measures to address, reduce and recover from information security incidents.

Business Continuity and Disaster Recovery​

Delivery of a business continuity and disaster recovery plan will enable draw.io Ltd to continue operating and enable the business to perform in the event of a severe incident or event.

  • Define, document and maintain the information security controls applied to systems identified as critical to business continuity and disaster recovery.
  • Define, document and maintain information security controls and practices within the business continuity and disaster recovery plans.

Compliance​

Information assets and systems are routinely audited to confirm compliance with draw.io Ltd Standards, regulatory, legislative and contractual requirements.

  • Identify, document and update all information security-focused compliance requirements for each information asset and system.

Insurer-Mandated Security Conditions​

draw.io Ltd's cyber liability policy imposes minimum security conditions as a contractual condition of cover. These are requirements placed on draw.io Ltd by the insurer. They are recorded here so that they are maintained as part of the information security programme rather than only in the policy documents.

  • Secure all remote access to draw.io Ltd computer systems, including any virtual private network and any cloud-based email service, with multi-factor authentication.
  • Back up all data assets at least once every seven days. Store backups securely and separately from the original data asset, and test backups for their efficacy - including their ability to be restored - at least once every six months.
  • Patch any vulnerability within draw.io Ltd computer systems described as high, important or critical severity by the relevant provider within 14 days of the patch first being made available.

These conditions are re-verified on each annual renewal.

Remote Access and Teleworking​

Remote access provides an effective and secure method of operating and accessing draw.io Ltd information assets and systems.

  • Implement information security controls commensurate with the criticality of information assets and systems at remote sites and remote access users (teleworking).
  • Adhere to the Endpoint Security Policy.