Cryptographic Controls Policy

Cryptographic Controls Policy

Document Name: Cryptographic Controls Policy
Version: 1.0
Approved by: Directors, Immercial Limited
Review Frequency: Annual or upon material change

Purpose

Immercial Limited uses cryptographic controls proportionately to protect information, support system security and provide independent verification of selected controlled records and governed states.

Cryptographic controls may include encryption, secure authentication, hashing, digital signatures and blockchain-based verification.

Approved Use

Cryptographic controls must be used only for authorised business purposes and through approved systems, services and algorithms.

Immercial currently uses cryptographic techniques including SHA-256 fingerprints and Algorand-based transaction verification within relevant IMME systems and services.

Confidential client, project, commercial and proprietary information must not be placed directly on a public blockchain. Only approved fingerprints and limited non-confidential verification information may be published or anchored.

Cryptographic Keys and Credentials

Private keys, seed phrases, recovery credentials, API secrets and other cryptographic secrets must:

• be accessible only to authorised persons;
• be stored securely using approved systems or secure credential-storage arrangements;
• not be disclosed through email, public repositories, website content, ordinary documents or other uncontrolled locations;
• not be shared with clients or third parties unless specifically required and securely authorised;
• be protected against loss, unauthorised disclosure, copying and misuse;
• be replaced, revoked or migrated where compromise is suspected or where a material change requires it.

Access to cryptographic credentials must follow Immercial’s Access Control Policy and least-privilege principles.

Blockchain and IMME Verified

Where Algorand is used for IMME Verified or other approved Immercial applications:

• transactions must be initiated only through authorised Immercial-controlled systems or accounts;
• the intended network and transaction purpose must be checked before submission;
• only approved information may be written to the public network;
• confidential source records and private manifests remain within controlled Immercial systems;
• transaction identifiers and relevant verification records may be retained as evidence;
• testing and production activity must be appropriately identified and controlled;
• blockchain verification does not replace professional judgement, contractual agreement or internal approval.

Hashing and Verification

Cryptographic hashes may be used to demonstrate the integrity or existence of a controlled state at a particular point in time.

A hash or blockchain record does not itself prove that the underlying information is commercially correct, contractually agreed or professionally approved. Those matters remain governed through Immercial’s normal controls and professional review.

Key Loss or Compromise

Suspected compromise, loss or unauthorised use of cryptographic credentials must be treated as an information-security incident and managed under Immercial’s Information Security Incident Procedure.

Where necessary, affected credentials must be disabled, replaced or migrated, relevant systems reviewed and any potentially affected verification activity assessed.

Third-Party Cryptographic Services

Where cryptographic functions depend upon cloud platforms, blockchain networks, wallet technology, APIs or other third-party services, those services are subject to proportionate supplier, access and information-security controls.

Immercial remains responsible for the configuration and credentials under its control but does not control the underlying operation of independent public networks.

Review and Responsibility

The Directors are responsible for approval and oversight of cryptographic controls.

This policy is communicated to relevant personnel and interested parties where applicable and is reviewed at least annually and following significant changes to cryptographic technologies, systems, services, risks or business use.