Skip to content

Changineers Engineering Handbook

Operations security

Index of the procedures that implement the Operations Security Policy.

The Operations Security Policy is published in the Changineers trust portal. This page is the handbook index for the procedures that implement it.

What’s required

Production systems are configured to a known baseline, kept current with patches, segmented at the network layer, and monitored continuously. Changes to production go through a controlled process with approval and rollback. Vulnerabilities that surface from any source are detected, triaged, and remediated.

Implementing procedures

Topic	Page
Production changes: proposing, reviewing, and deploying	Change management
Manual production changes when the standard process can’t be followed	Emergency change
Configuration baselines for AWS resources, VMs, network controls, Cognito, and engineer laptops	Configuration baselines
Metrics, logs, traces, and alarms	Observability
Authentication anomalies, account intrusion detection, audit logging	Threat detection
Vulnerability detection, triage, severity, and remediation	Vulnerability management

Management systems

Production AWS resources are defined as code in Terraform; changes go through the release pull request flow on Change management.

Engineers who need elevated AWS access for an exceptional case request it through AWS IAM Identity Center, federated from Google Workspace, with approval by the CTO. See Change management § Authorised actors.

Hiring & onboarding

Acceptable use of AI tools Approved software

Building software

Engineering principles Secure development Solution design Shipping code Penetration testing

Shipping & operations

Operations security Architecture Change management Emergency change Configuration baselines Observability Threat detection Vulnerability management

Data

Customer data deletion

Resilience & response

Incident response

Public

Modern slavery statement Responsible disclosure

Deprecated (pending removal)

Security Program Overview Policy Management Compliance Audits and External Communications Security Architecture and Operating Model Roles, Responsibilities and Training Risk Management System Audits, Monitoring and Assessments HR and Personnel Security Access Facility Access and Physical Security Data Management Data Protection Secure Software Development and Product Security Configuration and Change Management Threat Detection and Prevention Vulnerability Management Mobile Device Security and Media Management Business Continuity and Disaster Recovery Incident Response Breach Investigation and Notification Third Party Security and Vendor Risk Management Employee Handbook Subprocessors