Security you can check for yourself.

Who can reach production, how they prove it, and how the network is watched.

• Unique production database authentication enforcedProduction datastores require authorized, secure authentication such as unique SSH keys.
• Encryption key access restrictedPrivileged access to encryption keys is limited to authorized users with a business need.
• Unique account authentication enforcedSystems and applications require a unique username and password or authorized SSH keys.
• Production application access restrictedSystem access is restricted to authorized users only.
• Access control procedures establishedOur access control policy sets the requirements for adding, modifying and removing user access.
• Production database access restrictedPrivileged access to databases is limited to authorized users with a business need.
• Firewall access restrictedPrivileged access to the firewall is limited to authorized users with a business need.
• Production OS access restrictedPrivileged access to the operating system is limited to authorized users with a business need.
• Production network access restrictedPrivileged access to the production network is limited to authorized users with a business need.
• Access revoked upon terminationTermination checklists ensure access is revoked for leavers within SLAs.
• Unique network system authentication enforcedThe production network requires unique usernames and passwords or authorized SSH keys.
• Remote access MFA enforcedProduction systems can only be accessed remotely by authorized employees using multi-factor authentication.
• Remote access encrypted enforcedRemote access to production systems is only possible over an approved encrypted connection.
• Intrusion detection system utilizedAn intrusion detection system monitors the network continuously for early signs of a breach.
• Log management utilizedA log management tool identifies events that could affect our security objectives.
• Infrastructure performance monitoredInfrastructure monitoring raises alerts when predefined thresholds are met.
• Network segmentation implementedThe network is segmented to prevent unauthorized access to customer data.
• Network firewalls reviewedFirewall rulesets are reviewed at least annually, with required changes tracked to completion.
• Network firewalls utilizedFirewalls are in place and configured to prevent unauthorized access.
• Network and system hardening standards maintainedHardening standards are documented, based on industry best practice and reviewed at least annually.

The people who work on the service, and the devices and media they use.

• Asset disposal procedures utilizedMedia holding confidential information is purged or destroyed to best practice, with a certificate of destruction for each device.
• Production inventory maintainedA formal inventory of production system assets is maintained.
• Portable media encryptedPortable and removable media devices are encrypted when used.
• Anti-malware technology utilizedAnti-malware is deployed, routinely updated and logged on all relevant systems.
• Employee background checks performedBackground checks are performed on new employees.
• Code of Conduct acknowledged by contractorsContractor agreements include or reference our code of conduct.
• Code of Conduct acknowledged by employees and enforcedEmployees acknowledge the code of conduct when they join, and breaches are subject to disciplinary action.
• Confidentiality Agreement acknowledged by contractorsContractors sign a confidentiality agreement when they are engaged.
• Confidentiality Agreement acknowledged by employeesEmployees sign a confidentiality agreement during onboarding.
• Performance evaluations conductedManagers complete performance evaluations for their direct reports at least annually.
• Password policy enforcedPasswords for in-scope system components follow our password policy.
• MDM system utilizedMobile devices that support the service are centrally managed with mobile device management.
• Visitor procedures enforcedVisitors sign in, wear a badge and are escorted in the data center and secure areas.
• Security awareness training implementedEmployees complete security awareness training within 30 days of joining and at least annually after that.

How customer data is protected and how the service is tested.

• Data encryption utilizedDatastores housing sensitive customer data are encrypted at rest.
• Control self-assessments conductedControls are self-assessed at least annually, and corrective actions are completed within any committed SLA.
• Penetration testing performedPenetration testing is performed at least annually, with vulnerabilities remediated to SLA.
• Data transmission encryptedConfidential and sensitive data is encrypted when transmitted over public networks.
• Vulnerability and system monitoring procedures establishedFormal policies set the requirements for vulnerability management and system monitoring.

Governance, risk, incident response, continuity and change.

• Continuity and Disaster Recovery plans establishedBusiness continuity and disaster recovery plans keep security running if key people are unavailable.
• Continuity and Disaster Recovery plans testedThe BC/DR plan is documented and tested at least annually.
• Cybersecurity insurance maintainedCybersecurity insurance is held to limit the financial impact of a business disruption.
• Configuration management system establishedA configuration management procedure keeps system configurations consistent across the environment.
• Development lifecycle establishedA formal software development life cycle governs development, changes (including emergency changes) and maintenance.
• SOC 2 system description maintainedA description of the system is maintained for the SOC 2 audit report.
• Whistleblower policy establishedA formal whistleblower policy and an anonymous channel let anyone report issues or fraud concerns.
• Board oversight briefings conductedThe board is briefed at least annually on cybersecurity and privacy risk, and gives direction.
• Board charter documentedThe board has a documented charter covering its oversight of internal control.
• Board expertise developedBoard members have the expertise to oversee security controls, and bring in third-party experts as needed.
• Board meetings conductedThe board meets at least annually, keeps formal minutes and includes independent directors.
• Backup processes establishedOur backup policy sets the requirements for backing up and recovering customer data.
• System changes externally communicatedCustomers are told about critical system changes that may affect their processing.
• Management roles and responsibilities definedManagement roles for overseeing the design and running of security controls are defined.
• Organization structure documentedAn organizational chart sets out the structure and reporting lines.
• Roles and responsibilities specifiedResponsibility for each security control is formally assigned in job descriptions or our roles and responsibilities policy.
• Support system availableAn external support system lets users report failures, incidents, concerns and complaints.
• System changes communicatedSystem changes are communicated to authorized internal users.
• Access reviews conductedAccess to in-scope systems is reviewed at least quarterly, with required changes tracked to completion.
• Access requests requiredAccess is granted by job role, or by a documented request with manager approval.
• Incident response plan testedThe incident response plan is tested at least annually.
• Incident response policies establishedSecurity and privacy incident response policies are documented and communicated.
• Incident management procedures followedIncidents are logged, tracked, resolved and communicated to the people affected.
• Physical access processes establishedPhysical access to data centers is granted, changed and removed only with control-owner authorization.
• Data center access reviewedAccess to the data centers is reviewed at least annually.
• Company commitments externally communicatedOur security commitments to customers are set out in our customer agreements and terms of service.
• External support resources availableCustomers get guidelines and technical support resources for running the service.
• Service description communicatedA description of our products and services is provided to internal and external users.
• Risk assessment objectives specifiedObjectives are specified so that risks to them can be identified and assessed.
• Risk assessments performedRisk assessments, including fraud risk, are performed at least annually.
• Risk management program establishedA documented risk management program identifies threats, rates the risks and sets out how to mitigate them.

How customer data is classified, kept and deleted.

• Data retention procedures establishedFormal procedures govern the secure retention and disposal of company and customer data.
• Customer data deleted upon leavingCustomer data is purged from the application environment when customers leave the service.
• Data classification policy establishedA data classification policy keeps confidential data secured and restricted to authorized personnel.