Security

Governance‍

Our security program is built on documented policies and continuous monitoring, validated through independent third-party audits and certifications.

Our Security Principles

Least Privilege Access: We limit system access to only those with legitimate business needs, implementing role-based controls across all systems and applications.
Defense in Depth: Multiple layers of security controls protect your data, from network perimeter defenses to application-level encryption and monitoring.
Consistent Application: Security controls are applied uniformly across our entire platform, ensuring no gaps in protection regardless of where your data resides.
‍Continuous Improvement: We regularly assess and enhance our security posture through risk assessments, penetration testing, and control maturity evaluations.

Compliance & Certifications

SOC 2 Type II Certified Annual audits for Security and Availability

Financial Services Ready

• AML/KYC compliance workflows built-in
• Transaction monitoring capabilities
• Regulatory reporting features
• Financial data protection standards

Data Protection

Encryption at Rest

• Isolated Salesforce Organizations for each customer
• All production databases encrypted using AWS encryption
• S3 buckets encrypted for file storage
• DynamoDB tables with encryption enabled

Encryption in Transit

• TLS 1.2+ for all web sessions
• Secure SFTP with SSH key authentication
• Encrypted APIs for system integrations
• AWS Application Load Balancers managing certificates

Infrastructure Security

• Web Application Firewall (WAF) protecting against attacks
• Virtual Private Cloud (VPC) network isolation
• Hardware Security Modules (HSMs) for key management
• AWS CloudTrail for comprehensive audit logging

Security Operations

Continuous Monitoring

Real-Time Threat Detection

• SIEM monitoring production infrastructure 24/7
• Automated alerts for security anomalies
• CloudTrail logging all AWS account activity
• VPC traffic logs retained for one year minimum

Vulnerability Management

• Automated scanning in CI/CD pipeline
• Container scanning on every deployment
• Dependency vulnerability monitoring
• Security patches tracked and prioritized

Change Management

Secure Development Lifecycle

• All code changes require peer review and approval
• Automated security testing before production
• Separate development, testing, and production environments
• Integration testing includes vulnerability scanning
• Deployment notifications to engineering team

Incident Response

Structured Response Program

• Documented incident response procedures
• Bi-weekly security team meetings
• Root cause analysis for all incidents
• Annual tabletop exercises
• Disaster recovery plan with tested procedures

Access Controls

Identity Management

Google Workspace SSO Integration

• Multi-factor authentication enforced
• Centralized user provisioning
• Automated deprovisioning on termination
• Annual access reviews

Privileged Access

• Administrative access restricted to authorized personnel
• CI/CD system access limited to engineering team
• Production access requires MFA

User Access Management

• Documented access request procedures
• Management approval required for new access
• Automated reconciliation of user accounts
• Access removal tickets tracked for terminations

Vendor Management

Risk-Based Approach

We classify vendors based on:

• Data access levels
• System integration depth
• Business criticality

Security Assessments

• High-risk vendors require security documentation
• Annual reviews of critical service providers
• SOC 2 reports collected where available
• Security questionnaires for vendors without audits

Employee Security

Onboarding Standards

• Background checks for all positions
• Signed employment agreements with confidentiality clauses
• Code of Conduct acknowledgment required
• Information security policy acceptance

Ongoing Security Practices

• Annual security awareness training
• Endpoint protection on all devices
• Disk encryption mandatory
• Anti-malware software deployed
• Performance reviews address security responsibilities

Business Continuity

High Availability Architecture

• Load balancers distributing traffic
• Auto-scaling groups for demand management
• Multi-availability zone deployments
• 24/7 service availability commitment

Data Resilience

• Daily database backups
• Point-in-time recovery (35 days)
• Cross-availability zone replication
• Annual disaster recovery testing

Privacy & Data Handling

Data Governance

We maintain strict controls over data handling:

• Customer data used only for agreed services
• No sharing with third parties except as required for service delivery
• Data isolation between customers
• Clear data retention and deletion procedures

Regulatory Compliance

• Master subscription agreements defining security commitments
• Support for customer compliance requirements
• Strong data protection controls
• Regular compliance framework updates