Security

Last Modified: 6th May, 2024

1. INTRODUCTION

Keeping our platform secure is of utmost importance to us, and we have built our systems and procedures to standardize security. On and around the platform, we are responsible for technical and organizational security measures. As a result, we must implement the required security according to best practices. Here are a few highlights of the steps we take every day to maintain the platform's security and ensure that we apply the best security practices:

2. DATA ENCRYPTION

We employ industry-standard encryption protocols to safeguard your data during transmission and storage. All data communications to client instances are protected by 256-bit SSL encryption. All internal data communications between our servers are also protected with state-of-the-art encryption (SSH).

3. PASSWORD SECURITY

3.1 All passwords are encrypted using industry-standard methods.
3.2 Login credentials are always transmitted securely over HTTPS.
3.3 Our staff do not have access to your password and cannot retrieve it for you; the only option if you lose it is to reset it.
3.4 Our password policy has a built-in setting for enforcing a minimum user password length.

4. PAYMENT SECURITY

We do not store credit card information. Your credit card information is always transmitted securely and directly between you and our PCI-compliant payment gateways.

5. SERVER AND NETWORK SECURITY

4.1 All cloud servers are running hardened Linux distributions with up-to-date security patches.
4.2 Firewall systems and other security measures are implemented on our servers to detect and block intrusions and other threats.
4.3 Our team regularly monitors our system for any potential vulnerabilities and patches them quickly.
4.4 Only a few engineers have clearance to manage the servers, and access is only possible using an encrypted SSH key pair.
4.5 Our cloud infrastructure providers provide servers with standard hardware guarantees, redundant data storage, network and electrical supplies.

6. SOFTWARE SECURITY

6.1 Our whole codebase is designed to prevent the introduction of SQL injections and other attacks.
6.2 All new codes go through a review process that includes security inspections for new and contributed pieces of code.
6.3 We actively review customer feedback to enhance our platform. Feature requests and bug reports are considered for future development.

7. TEST ENVIRONMENTS

We maintain separate staging and test environments to safely test updates, patches, and new features before deploying them to the live production environment.

8. ACCESS CONTROL

Administrative access is restricted to authorized personnel only, and stringent access controls are in place to prevent unauthorized access. System access is also role-based and passwords are changed regularly.

9. BACKUPS AND DISASTER RECOVERY

9.1 Our disaster recovery plans are regularly reviewed to ensure minimal downtime in the event of system failures. 
9.2 Regular automated backups are performed to ensure data availability and integrity.
9.3 Backup data is securely stored.

10. MONITORING AND ALERTS

We use monitoring tools to proactively track application performance, availability, and security. Automated alerts are set up to notify our support team of potential issues or irregularities.