a) Access Control
i) Preventing Unauthorized Product Access
Outsourced processing: Data importer hosts its Service with outsourced cloud infrastructure providers. Additionally, the data importer maintains contractual relationships with vendors in order to provide the Service in accordance with our Clauses. The data importer relies on contractual agreements, privacy policies, and vendor compliance programs in order to protect data processed or stored by these vendors.
Authentication: the data importer implemented a uniform password policy for its customer product. Customers who interact with the product via the user interface must authenticate before accessing non-public customer data.
Authorization: Personal data is accessible to Customers via only application user interfaces and application programming interfaces. Customers are not allowed direct access to the underlying application infrastructure. The authorization model in each of the data importer’s products is designed to ensure that only the appropriately assigned individuals can access relevant features, views, and customization options. Authorization to data sets is performed through validating the user’s permissions against the attributes associated with each data set.
ii) Preventing Unauthorized Product Use
The data importer implements industry standard access controls and detection capabilities for the internal networks that support its products.
Access controls: Network access control mechanisms are designed to prevent network traffic using unauthorized protocols from reaching the product infrastructure.
Penetration testing: the data importer maintains relationships with industry recognized penetration testing service providers for regular penetration tests. The intent of the penetration tests is to identify and resolve foreseeable attack vectors and potential abuse scenarios.
iii) Limitations of Privilege & Authorization Requirements
Product access: A subset of data importer’s employees have access to the products and to personal data via controlled interfaces, including, where applicable, via multi-factor authentication mechanisms. The intent of providing access to a subset of employees is to provide effective customer support, to troubleshoot potential problems, to detect and respond to security incidents and implement data security.
(b) Transmission Control
In-transit: The data importer makes HTTPS encryption (also referred to as SSL or TLS) available on every one of its login interfaces and for free on every customer site hosted on the data importer products. The data importer’s HTTPS implementation uses industry standard algorithms and certificates.
At-rest: The data importer stores user passwords following policies that follow industry standard practices for security. The data importer has implemented technologies to ensure that stored data is encrypted at rest.
(c) Input Control
Detection: The data importer designed its infrastructure to log extensive information about the system behavior, traffic received, system authentication, and other application requests. Internal systems aggregated log data and alert appropriate employees of malicious, unintended, or anomalous activities. The data importer’s personnel, including security, operations, and support personnel, are responsive to known incidents.
Response and tracking: Suspected and confirmed security incidents are investigated by security, operations, or support personnel; and appropriate resolution steps are identified. For any confirmed incidents, the data importer will take appropriate steps to minimize product and data exporter damage or unauthorized disclosure. Notification to the data importer will be in accordance with the terms of the Clauses.
(d) Availability Control
Infrastructure availability: The infrastructure providers use commercially reasonable efforts to ensure a minimum of 99.9% uptime.
Online replicas and backups: All databases are backed up and maintained using at least industry standard methods.
