Snapshot 16838
Normalized text
Scripts and page chrome removed; this is what change detection compares.
How Skyflow Keeps Your Data Safe We go above and beyond industry security requirements to ensure that your data is secure. Security Controls Skyflow's team, processes and technologies use a three-pronged approach to protect customer data: 1. Application-Level Security Control Security Development Lifecycle We follow established security patterns for hardening, encryption, authentication and authorization. Our security team performs regular risk-based threat analysis during development cycles to continually re-evaluate and refine our security posture. To ensure additional security of our platform, we regularly conduct the following security checks: Peer design and code review Internal vulnerability scans as well as contracts with Approved Scanner Vendors (ASV) to scan for vulnerabilities Contracts with top penetration testers to perform offensive and defensive analysis of our application and infrastructure Leverage talents and skills of global security researchers by running paid Bug Bounty programs to look for vulnerabilities Access Control of Customer Data As it relates to policy, we employ the principle of least privilege — engineers are only granted the authorization required to perform their job functions. The following details the type of access we have internally to customer’s data: Type of Access Infrastructure Application Production Systems Direct access to production systems is disallowed unless user has documented approval. Special provisioning of a fully audited and fine grained access controlled virtual bastion host is required to access production environments. Skyflow employees do not have permissions to access customer vault data unless explicitly authorized by customer’s vault administrators. Tools & Systems Access to tools and systems that interact with the production system is managed through respectively built in access control and is limited to trained operation engineers. Access to Skyflow vaults is controlled by a built-in policy-based access control system; only authorized tools can gain access to their respective vault data. 2. Infrastructure-Level Security Control Audits and Accountability Skyflow’s platform has detailed audit logging to track all security-sensitive events on a centralized log server for analysis and alerts. To maintain constant operational security of the platform, we conduct the following maintenance: All changes to production systems require documented approvals All changes to the Skyflow platform software application require documented peer engineering review and approvals Architecture The Skyflow platform architecture sets up an independent network security zone at the Workspace and Vault level to protect data from each customer so access rules are fully customizable and hardened to each environment. Additionally, the network and data segmentation also limits the potential impact from any individual system failures. Media Protection All storage media used in production are enabled with encryption. Further, the Skyflow application, per configuration, performs application encryption to protection-marked data sets using encryption keys managed by the Skyflow systems. System and Communication Protection All inter-system communications within Skyflow are encrypted and routed through private channels only and do not enter the public internet. All ingress and egress communications are controlled by network security and are periodically reviewed and approved by the security team. Recovery Skyflow infrastructure employs multiple levels of system recovery and data recovery scheme, including as the following: Production system data is continuously backed up to ensure low Recovery Point Objective ( RPO ) to minimize data loss during DR Production infrastructure operations are streamlined and automated to ensure low Recovery Time Objective ( RTO ) to minimize operation disruption during DR All services are deployed on AWS Multi Availability-Zone ( multi-AZ ) setup, clustered and continuously monitored to ensure high availability Data backup is AWS cross region to ensure cross region data recovery Data is regularly backed up and tested Identification and Authentication We have implemented Multi-Factor Authentication-based Single Sign-On for infrastructure system access. System management tools have built-in support for Skyflow’s SSO system. Exceptions require the implementation of strong passwords to minimize the risk of credential theft or brute force attacks. 3. Operation-Level Security Control For security operations, Skyflow covers a number of areas detailed below: Domain System Controls Vulnerability Management Deploys numerous vulnerability and security scanners to ensure all systems are up to date with supported versions and patches Configuration Management Establish and maintain baseline configuration for all systems All changes to production systems require documented approvals All changes to the Skyflow vault application require documented engineering review and approvals System and Information Integrity Continuous monitoring of production systems and alerts are set up to ensure systems are performing as designed and comply with service level agreements Threat Detection Skyflow subscribes to threat detection services to monitor health and state of the production system Skyflow customizes rule-based alerts to look for potential threats Incident Response 24x7 staff availability Established runbook Breach notification procedure following compliance and best practices guidelines Staffing and Continued Education We maintain a high level of organizational and employee compliance and security standards with role-based mandatory training. They ensure that we stay up to date with responsibilities and guidelines for handling security, system and any data. These efforts include: Mandatory training during new hire onboarding Skyflow works with a training firm to develop new content for ongoing security training CISSP and CISA on staff to help provide the expertise in security and compliance Report a Vulnerability If you believe you have found a security issue on Skyflow Data Privacy Vault, please submit a report to our security team via email [email protected]. Bug Bounty Program We have a private bug bounty program to cover security research on Skyflow Data Privacy Vault. You could join our bug bounty program by inquiring at [email protected]. The bug bounty registration will have the scope and program details. Certifications and Compliance Our platform environment and team adhere to the following standards: ISO 27001:2022 Certified SOC 2 Type II Certified PCI DSS Level 1 Certified GDPR Assessed and Compliant HIPAA Assessed and Eligible Mastercard Site Data Protection (SDP) Compliant Registered Service Provider Visa Global Registry Registered Service Provider EU-US Data Privacy Framework (DPF) VeraSafe EU Representative Trust Seal The team at Skyflow is dedicated to ensuring that your sensitive data is stored and utilized securely. Contact us to schedule a demo, or check out our docs to learn more.