Security & Data Protection

Gifford Productions takes the security and confidentiality of client information seriously. We use documented security, privacy, access-control, and artificial-intelligence practices designed for the types of video-production and learning-management-system services we provide.

Our approach combines appropriate internal controls with established cloud, hosting, collaboration, and business-service providers.

Information Security

Gifford Productions uses administrative and technical safeguards designed to protect non-public client, business, and learner information.

Our practices include:

  • Multi-factor authentication on key business systems
  • Multi-factor authentication for WordPress administrative access where implemented
  • Individual account access and limited use of shared credentials
  • Least-privilege access
  • Restricted administrator privileges
  • HTTPS encryption for websites and learning management systems
  • Managed cloud hosting
  • Automated backups and restoration capabilities
  • Contractor confidentiality and security requirements
  • Documented rules governing artificial intelligence and confidential information
  • Removal of access when it is no longer required

Security practices are reviewed as our systems, services, and client requirements evolve.

Learning Management System Security

Gifford Productions develops, hosts, and supports customized learning-management-system environments designed around client training, reporting, certification, and access requirements.

Administrative access is limited to individuals who require it for legitimate business purposes. Where appropriate, clients are provided role-based access for reporting and management functions rather than full administrative privileges.

LMS environments may contain information such as:

  • Learner names and email addresses
  • Employer or organization information
  • Professional or certification license numbers
  • Course progress
  • Quiz or assessment results
  • Completion records
  • Certificates
  • Login or activity information

Gifford Productions treats identifiable learner records as sensitive information and limits access according to project and client requirements.

Hosting and Backups

Gifford Productions uses managed WordPress hosting for its websites and LMS environments.

Our hosting environment provides infrastructure-level security capabilities including HTTPS support, firewall and network protections, monitoring, backup services, and restoration capabilities.

WordPress/LMS environments are backed up automatically, and backup restoration has been successfully used in actual operations.

Where clients have additional hosting, retention, or backup requirements, those requirements can be evaluated as part of the engagement.

Artificial Intelligence and Client Information

Gifford Productions uses business artificial-intelligence tools to support legitimate project and operational activities.

Typical uses may include:

  • Proposal development
  • Script development
  • Course and training content
  • Project planning
  • Research
  • Draft communications
  • LMS content development
  • Business operations

Gifford Productions maintains an internal AI & Confidential Information Policy that classifies information according to sensitivity and establishes rules for how information may be used with AI systems.

Client-confidential information may be used with approved business AI tools when there is a legitimate business purpose, the use is permitted by applicable client requirements, and the information provided is limited to what is reasonably necessary.

Gifford Productions does not intentionally submit Restricted information to generative AI systems for routine processing.

Restricted information includes categories such as:

  • Identifiable learner or student records
  • Passwords
  • Multi-factor authentication codes
  • API keys or authentication tokens
  • Recovery codes
  • Full payment-card information
  • Sensitive banking credentials
  • Government identification numbers
  • Information specifically prohibited from AI processing by a client

Client-specific contractual or security restrictions on AI use take precedence over our standard practices.

Contractors and Freelancers

Gifford Productions may use qualified contractors and freelancers to support client projects.

Contractors who receive access to non-public information are subject to documented confidentiality and security requirements.

These requirements address areas including:

  • Confidentiality
  • Least-privilege access
  • Account and password security
  • Multi-factor authentication where appropriate
  • Approved storage locations
  • Artificial-intelligence use
  • Protection of learner information
  • Subcontracting
  • Security incident reporting
  • Return or deletion of project information
  • Removal of access at the end of an engagement

Contractors are given access only to information and systems reasonably necessary for their assigned work.

File Storage and Collaboration

Gifford Productions uses established cloud services for business storage, project collaboration, and client review.

Access is limited according to project requirements, and multi-factor authentication is used on key storage and collaboration services.

We seek to avoid unnecessary duplication of client information across systems and to remove access when it is no longer required.

Forms, Surveys, and Personal Information

Gifford Productions may collect personal information through:

  • Website contact forms
  • Scheduling tools
  • Client communications
  • LMS registration and administration
  • Course surveys and evaluations
  • Billing and invoicing systems

We seek to collect only information reasonably necessary for the applicable business, training, or client purpose.

Where IP-address storage is not needed for website or survey forms, Gifford Productions may configure forms not to retain that information.

For more information about our collection and use of personal information, please review our Privacy Policy.

Payments and Financial Information

Gifford Productions primarily uses established third-party accounting and payment providers for invoicing and payment processing.

We do not intentionally place full payment-card information, banking credentials, passwords, or similar Restricted information into generative AI systems.

Video and Embedded Media

Gifford Productions uses established video-hosting services such as Vimeo and YouTube to deliver video content on websites and learning-management systems.

Third-party video services may process technical information when embedded players are loaded. Additional information about third-party services is provided in our Privacy Policy.

Incident Response

Gifford Productions treats suspected unauthorized access, credential compromise, accidental disclosure, malware, data loss, and similar events as potential security incidents.

Depending on the circumstances, response actions may include:

  • Containing the issue
  • Revoking or changing credentials
  • Identifying affected systems or information
  • Coordinating with hosting or technology providers
  • Restoring systems from backup
  • Evaluating client notification requirements
  • Evaluating legal or regulatory obligations
  • Documenting corrective actions

Contractors are required to report suspected security or privacy incidents promptly.

Data Retention

Information is retained according to applicable business, contractual, legal, regulatory, accounting, training, certification, and security requirements.

Some training or certification records may require longer retention periods than ordinary project information.

Gifford Productions continues to review and formalize system-specific retention and deletion practices.

Third-Party Service Providers

Gifford Productions uses established third-party providers for functions such as:

  • Website and LMS hosting
  • Business email
  • Cloud storage
  • File collaboration
  • Accounting and payment processing
  • Video hosting
  • Scheduling
  • Artificial intelligence
  • Project and business information management

Third-party security certifications or attestations apply to the applicable service provider and should not be interpreted as certifications held by Gifford Productions.

Certifications and Security Frameworks

Gifford Productions does not currently claim independent certification under SOC 2, ISO/IEC 27001, or comparable enterprise security standards.

We instead focus on maintaining documented, verifiable security practices appropriate to our size, services, systems, and client requirements.

We continue to evaluate formal security frameworks and independent assessments as our business and client requirements evolve.

Client-Specific Security Requirements

We recognize that organizations have different requirements for:

  • Information security
  • Privacy
  • Artificial-intelligence use
  • Data retention
  • Access control
  • File storage
  • Authentication
  • Vendor management

Gifford Productions can evaluate reasonable client-specific security requirements as part of an engagement.

Where agreed requirements are more restrictive than our standard practices, the agreed client requirements take precedence.

Security and Privacy Questions

Clients, procurement teams, and information-security personnel may contact us for additional information or request our more detailed Client Security & Data Protection Overview.

Gifford Productions
Email: info@giffordproductions.com
Website: GiffordProductions.com