Security Practices

1. Purpose and Scope

This Security Practices page describes, in general terms, the measures Acadia Marketing LLC, a Maine limited liability company ("Acadia Marketing LLC", "we", "us"), uses to protect information and systems involved in our website design and development, website hosting, domain name management, email setup, search and advertising management, SMS and text-message lead alerts, and client website and domain transfer services. It applies to acadiamarketingmaine.com and to any page, subdomain or transfer page we operate or issue to clients (the "Sites").

This page supplements our Terms of Use, Privacy Policy, Cookie Notice, Website and Domain Transfer Terms, Access Code and Authentication Policy, Access Logging and Security Notice, and Acceptable Use Policy. Where the applicable agreement with a client addresses a subject more specifically, that agreement controls.

2. Access Controls

We limit access to client systems, accounts and data to the people and services that need it to perform the work. Administrative areas of the Sites, hosting accounts, registrar accounts and advertising accounts require authentication. Where a provider offers additional verification at sign-in, we use it for accounts that control client assets. Access that is no longer needed is removed as part of closing out an engagement or completing a transfer.

3. Least Privilege

We assign each person, tool and integration only the permissions required for its function. Administrative rights are held by a limited group and granted for the task at hand. Where a client gives us delegated access to an account the client owns, we request the narrowest level of access that allows us to deliver the services described in the applicable agreement.

4. Credential Handling

Passwords, access codes, transfer codes, application keys and similar secrets are treated as confidential. We store them in access-restricted locations designed for that purpose and do not place them in publicly accessible files, page source or general messages. We use separate credentials for separate systems wherever practical and replace credentials when we have reason to believe they may have been exposed. We do not ask clients to disclose a password in an unsecured message. An access code sent to a phone number or email address is for the designated recipient only and should not be shared with anyone else.

5. Encryption in Transit

The Sites are served over encrypted connections, and we configure the services we manage with the intent that traffic between visitors, administrators and our systems is protected in transit using current, widely accepted protocols. We configure email authentication records on domains we manage so that receiving systems can verify messages sent on a client's behalf. Encryption in transit protects data while it moves between systems, but it does not protect data once it reaches a device or account outside our control.

6. Logging and Monitoring

We and our service providers maintain logs of activity relating to the Sites and related systems, such as access attempts, administrative actions, form submissions and message delivery. Logs are used to operate and secure the services, investigate suspected misuse and troubleshoot problems. They are accessible only to authorized personnel and are kept for the period needed for those purposes or as the applicable agreement or law requires.

7. Vulnerability Handling

We review the software and platforms we use for the Sites and apply updates and fixes as part of ordinary maintenance. When we learn of a vulnerability or suspected incident, we assess its significance, take reasonable steps to contain and correct it, and, where required by law or the applicable agreement, notify affected clients through the contact method on file.

If you believe you have found a security issue affecting the Sites, please report it to info@acadiamarketingmaine.com with enough detail for us to reproduce it. Please do not access, change or keep data that is not yours, do not disrupt the Sites, and give us a reasonable opportunity to respond before disclosing the issue to others. Testing that violates our Acceptable Use Policy is not authorized.

8. What Clients Must Do

Security is shared. Clients are responsible for the following on their side:

• Keeping their own passwords, access codes, transfer codes and recovery details confidential, and choosing strong, unique credentials.
• Using additional verification on accounts that offer it, including registrar, email, hosting and advertising accounts.
• Keeping devices used to reach their accounts updated and protected.
• Limiting who receives access, and telling us when someone should no longer have it.
• Keeping contact details current so that we can reach them about security matters.
• Reporting suspected unauthorized access, lost devices or suspicious messages to us without delay.
• Confirming any message that appears to come from us and requests credentials or payment details, using the contact details on this page.

9. No Absolute Security

No method of transmission, storage or administration is completely secure. Although we use measures we consider reasonable, we cannot guarantee that unauthorized access, loss, alteration or disclosure will never occur, and nothing on this page is a promise of any particular security outcome. Our responsibilities and limits on liability are set out in the applicable agreement and in our Disclaimers and Limitation of Liability. Where hosting continues under the existing agreements after a transfer, these practices continue to apply to the services we still provide.

10. Changes and Contact

We may update these Security Practices from time to time. The version posted on the Sites is the version in effect. Questions may be sent to Acadia Marketing LLC, 218 Pond Road, Wilton, ME 04294, by email to info@acadiamarketingmaine.com, or by telephone at (207) 716-9079. Notices are given as described in our Electronic Communications and Notices. This page is governed by the laws of the State of Maine, with venue in Cumberland County, Maine, as further provided in our Governing Law and Dispute Resolution.