Is my data secure

Protecting your data

Ramon avatar
Written by Ramon
Updated over a week ago

Several layers of data security is built into our service to protect your data including your files and personally identifiable information (PII).

Encryption

  • All customer data stored in our service is encrypted using industry standard AES-256 encryption

  • End-to-end 256 bit HTTPS SSL encryption during data transfer

  • No financial data or credit card information is stored in any or our servers

  • Any user passwords are stored as one-way hashes, no one has access to your passwords

Firewalls

  • All ports and network interfaces are blocked by default using our global & regional Web Access Firewalls

  • Global firewall rules can detect and counter Denial of Service attacks

  • Combination of continuously updated rules to mitigate OWASP threats

  • Automatically ban know bad actors' IP addresses

  • Periodic third-party security vulnerability scans on all our public endpoints

Disaster recovery

  • In the event of server failure, all critical systems have redundant failover to prevent service disruptions

  • Customer data is replicated in at-least 3 data centers

  • Application load balancer can automatically route to new instances should any of them become unhealthy

Source Code

  • Continuous static code analysis of all our code using the latest AI/ML code scanners

  • We use a Continuous Integration and Continuous Delivery pipeline to test every code change

  • All dependencies including OS are automatically scanned for security vulnerabilities

  • No PII is logged by our code to ensure developers only work with anonymized data

Secrets & Password Management

We follow industry best practices for tracking secrets, passwords & keys that may be needed in any production or development systems.

  • No employee has access to ant master access keys

  • Access keys are never stored in any version control system, plaintext or files

  • Secure secret manager service is used by our servers to fetch needed keys & secrets

  • Developers do not have direct access to any production system, software updates are automatically deployed without human intervention

  • Secure industrial strength password manager is used by staff to access their own keys and never shred via email or chat

Employee Training

  • All employees have been trained on best practice security policies

  • Our employees are granted least privileged, minimal role based access to resources for troubleshooting on a need basis

  • Any employee access to sensitive data is audited and monitored
    โ€‹

Did this answer your question?