How we protect the data our customers trust us with.

Management system

Our security program is structured as an information security management system with defined scope, roles, risk assessment, internal audit, management review and corrective action, aligned to ISO/IEC 27001:2022.

Access reviews

Access to our cloud, source code and productivity systems is reviewed every quarter against the current staff list. Privileged access is reviewed with particular care, and the results are signed off by management.

Continuous monitoring

A compliance platform is connected to our infrastructure, code hosting and staff devices. It tests our controls automatically every day and raises anything out of line with the security owner.

Vendors

We assess the security of a supplier before sharing confidential data with them and put a written agreement in place first. Critical suppliers are reviewed annually.

Encryption

Data at rest is encrypted with industry-standard ciphers using keys held in our cloud provider's managed key service, with automatic rotation. Data in transit over public networks is protected with TLS 1.2 or higher.

Secrets

Credentials and application secrets are kept in a managed secrets service and supplied to systems at runtime. They are never written into source code, and access to them is logged.

Backups and resilience

Production databases take continuous, encrypted backups that allow recovery to a point in time, and run across multiple availability zones. Restores from backup are tested on a regular schedule.

Data residency

Our production environment is hosted in Australia. Production data is not copied into development or test environments.

Code review

Changes are made through pull requests that require an independent review before they can be merged. Protected branches prevent anyone, including administrators, from bypassing that review. Vulnerable dependencies are flagged automatically and updated.

Environments and deployment

Staging and production are separate environments. Our infrastructure is defined as code, and deployments run from an automated pipeline using short-lived credentials rather than long-lived keys.

Logging and detection

Administrative and API activity across our cloud environment is logged centrally with tamper-evident log validation. Threat detection and security posture services are enabled, and alerts page an on-call engineer.

Penetration testing and vulnerability management

Penetration tests are carried out at least annually and after significant changes to the platform, with findings tracked to closure. Between tests, findings from dependency scanning, cloud security services and external advisories are triaged by severity against defined remediation targets. Actively exploited vulnerabilities are escalated regardless of score.

Endpoints

Staff and contractor laptops run a device agent that verifies full-disk encryption, antivirus and a password manager, and reports to our compliance platform. Devices that fall out of compliance are flagged to their owner.

Identity and access

Access to our cloud environment goes through single sign-on with role-based permissions, and two-factor authentication is enforced on our source code hosting. Administrative access is limited to a small number of named people. When someone leaves, their access is removed following a written checklist.

People

New starters are screened before they join. Everyone signs a confidentiality agreement and our Code of Conduct, and completes security awareness training at hire and every year after. Engineers receive secure-development training.

Change management

Changes are classified by risk. Higher-risk changes need a risk assessment, a rollback plan and management sign-off. The author of a change is never its sole approver, and the review and deployment history forms the change record.

Incident response

Incidents are classified by severity with defined response targets, the most serious handled immediately around the clock. Every significant incident ends with a root-cause review, and the plan is tested at least annually.

Breach notification

Intellia is subject to the Australian Notifiable Data Breaches scheme. If an eligible breach is suspected we assess it promptly and, where serious harm is likely, notify the regulator and affected individuals. Contractual notification commitments to customers are tracked and met.

Business continuity

Recovery objectives are set for each service and reviewed annually. Infrastructure can be rebuilt from code, and the disaster recovery plan is exercised as a tabletop at least once a year.

Privacy

Personal information is handled under the Australian Privacy Principles. Our privacy policy explains what we collect, why, how long we keep it and how to make a request about it. Privacy-by-design is part of how we build new features.