We take customer data security extremely seriously. Safeguarding sensitive information and upholding the highest standards of privacy and data protection are fundamental to maintaining customer trust.

Our information security management system has been designed according to the ISO/IEC 27001 international standard for information security. This ensures that information risks are properly identified and addressed through a robust set of security policies, procedures, and controls.

We conduct regular security audits and reviews to identify any gaps or issues. Any non-conformities identified through auditing are documented, assigned ownership, and tracked to completion. This allows us to continually evaluate and improve our security posture over time.

All customer-related data is stored within secure database servers located in ISO/IEC 27017 compliant data centers. The data centers have stringent physical and environmental controls to prevent unauthorized access, damage, or interference. Entry is restricted and continuously monitored with security cameras.

The database servers are deployed in a segmented, multi-tier architecture with firewalls and network access controls separating each tier from one another. Database activity and access is logged for audit and detection purposes. Critical systems and databases are replicated to secondary failover instances in separate availability zones to ensure continuity of operations.

Encryption is implemented throughout to protect data confidentiality. Data transmitted over public networks is encrypted using TLS 1.3. Data stored ‘at rest’ within databases and files is encrypted using AES-256. Cryptographic keys are securely stored androtated regularly per our key management policy.

We perform regular vulnerability scanning of internet-facing applications and network infrastructure using manual and automated tools. Any critical or high-risk vulnerabilities identified are prioritized and remediated immediately according to a defined severity/response matrix.

Access to systems and data is governed through the principle of least privilege – users are only granted the minimal permissions necessary to perform their work. A strong authentication system based on multi-factor authentication is implemented for all access. User accounts are reviewed periodically and deactivated promptly on staff termination.

A centralized identity and access management system provides single sign-on capability while enforcing centralized access controls, approval workflows and automatic provisioning/deprovisioning of accounts and entitlements. Detailed system change, access and activity logs are retained for audit and reviewed for anomalies.

Robust monitoring and threat detection mechanisms are put in place using security information and event management (SIEM) solutions to detect cybersecurity incidents in real-time. Anomalous or malicious activity triggers alerts that are reviewed by our security operations center for an immediate response.

Data loss prevention measures detect and prevent unauthorized transfer of sensitive data onto systems or removable media. Watermarking is used to help identify the source if confidential data is compromised despite protective measures.

Vendor and third party access is tightly controlled and monitored. We conduct security and compliance due diligence on all our service providers. Legally binding agreements obligate them to implement security controls meeting our standards and to notify us immediately of any incidents involving customer data.

All employees undergo regular security awareness training to learn how to identify and avoid social engineering techniques like phishing. Strict policies prohibit connections to unsecured or public Wi-Fi networks, use of removable storage devices or unauthorized SaaS applications. Breaches are subject to disciplinary action.

We conduct simulated cyber attacks and tabletop exercises to evaluate the efficacy of our plans and responses. Lessons learned are used to further improve security controls. An independent external auditor also conducts annual privacy and security assessments to verify ongoing compliance with security and privacy standards.

We are committed to safeguarding customer privacy through stringent controls and will continue to invest in people, processes and technologies to strengthen our defenses against evolving cyber threats. Ensuring the highest standards of security is the priority in maintaining our customers’ trust.