Security controls

Access control · 2 ⌄

• Multi-factor authentication Multi-factor authentication is required for access to production systems and company accounts.
• Role-based access Access is granted by role on a least-privilege basis and reviewed regularly.

Application security · 3 ⌄

• Annual penetration test An independent third party tests the product at least once a year.
• Dependency vulnerability scanning Code and third-party dependencies are scanned for known vulnerabilities.
• Peer-reviewed code changes All code changes are reviewed by another engineer before release.

Business continuity · 2 ⌄

• Regular backups Customer data is backed up automatically and backups are encrypted.
• Tested disaster recovery Recovery from backups is tested at least once a year.

Data privacy · 2 ⌄

• Customer data deletion Customer data is deleted on request and after contract end.
• Privacy policy and data subject requests We publish a privacy policy and handle access and deletion requests.

Data security · 3 ⌄

• Encryption at rest Customer data is encrypted at rest.
• Encryption in transit All data in transit is encrypted with TLS 1.2 or higher.
• Logical separation of customer data Customer data is logically separated between customers.

Infrastructure · 2 ⌄

• Infrastructure monitoring and logging Systems are monitored and security-relevant events are logged.
• Reputable cloud hosting The product is hosted with a major cloud provider in certified data centers.

Network security · 1 ⌄

• Firewalls and network segmentation Production networks are protected by firewalls and segmented from other environments.

Vendor management · 1 ⌄

• Vendor security reviews Vendors that handle customer data are reviewed before use and periodically after.