Security and privacy overview

Infrastructure monitoring

Production infrastructure is monitored for availability, reliability, and security issues.

Automatic backups

Automatic backups support customer data recovery and service continuity.

Remote access MFA enforced

Production systems are only remotely accessible to authorized staff with multi-factor authentication.

Encrypted remote access

Remote production access requires an approved, encrypted connection.

Production data segmented

Customer data is never used or stored in non-production environments.

Network segmentation

Network segmentation limits the blast radius of unauthorized access.

Unique network authentication

Production network access requires unique credentials or authorized keys.

Unique account authentication

Systems and applications require unique per-user authentication.

Multi-zone infrastructure

Services run across multiple availability zones to support recovery if one is unavailable.

Vulnerability monitoring

Formal procedures govern vulnerability management and ongoing system monitoring.

Secure development practices

Software delivery follows secure development practices from implementation through release.

Secrets management

Credentials, keys, and sensitive configuration are managed through a dedicated secrets manager, never checked into source.

Input validation

Application inputs are validated to protect product workflows and customer data.

Employee background checks

Background checks are performed for new employees.

Security awareness training

Employees complete security awareness training at onboarding and at least annually.

Contractor confidentiality agreements

Contractors sign confidentiality agreements at engagement.

Production inventory maintained

A formal inventory of production system assets is kept up to date.

Employee confidentiality agreements

Employees sign confidentiality agreements during onboarding.

Asset disposal procedures

Electronic media containing confidential information is purged or destroyed per best practice.

Continuity and disaster recovery tested

BC/DR plans are documented and tested at least annually.

Incident response plan tested

The incident response plan is tested at least annually.

Access requests required

Access is granted by job role or a documented, manager-approved request.

Backup processes established

Backup and recovery requirements for customer data are documented.

Incident response policy established

Security and privacy incident response policies are documented and communicated.

Configuration management

Configuration procedures keep production systems consistent.

Management roles defined

Management oversees control design and implementation responsibilities.

Service description communicated

Product and service descriptions are communicated to users.

Security policies reviewed

Security policies are documented and reviewed at least annually.

Support system available

Users can report failures, incidents, concerns, and complaints.

Roles and responsibilities specified

Security control responsibilities are formally assigned.

Data center access reviewed

Cloud provider data center access is reviewed at least annually.

Development lifecycle established

A formal SDLC governs systems and technology changes.

Cybersecurity insurance maintained

Cybersecurity insurance mitigates the financial impact of a disruption.

Continuity communication plans

BC/DR plans include communication plans to support continuity.

Privacy policy established

The privacy policy communicates what's collected, our obligations, and how to reach us.

Data retention procedures

Formal retention and disposal procedures guide secure handling of data.

Privacy complaint procedures

Privacy complaints are addressed, documented, tracked, and communicated.

Privacy policy available

The privacy policy is available before or when information is collected.

Privacy policy reviewed

The privacy policy is reviewed when changes occur or on a regular cadence.

Privacy policy maintained

The policy explains jurisdictions, rights, data categories, collection, and disclosures.

Data deletion requests handled

Deletion requests are validated, tracked, and completed under applicable requirements.

Continuity plans established

BC/DR communication plans support continuity if key personnel are unavailable.

Continuity plans tested annually

The documented BC/DR plan is tested annually.

Collection minimized

Personal data collection is limited to the minimum necessary for its purpose.

PII encrypted in transit

Personal data is encrypted in transit end to end.