Snapshot 28117
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Security at Mainstay Security at Mainstay Protecting what matters most to our partners and their users At Mainstay, we strive to deliver solutions that are built thoughtfully to reinforce security, privacy, and confidentiality. Why? To create and promote trust and confidence between Mainstay and our partners. Read on to learn more about our commitment to security. Trusted by Security Organization and Program Our Commitment to Security Mainstay maintains a risk-based assessment security program. The framework for Mainstay’s security program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the Services and confidentiality, integrity, and availability of Customer Data. Mainstay’s security program is intended to be appropriate to the nature of the Services and the size and complexity of Mainstay’s business operations. Independent audits and assessments are performed by third parties. Confidentiality Respect for Privacy Mainstay has controls in place to maintain the confidentiality of Customer Data in accordance with Customer Agreements. All Mainstay employees and contract personnel are bound by Mainstay’s internal policies regarding maintaining the confidentiality of Customer Data and are contractually obligated to comply with these obligations. How is data encrypted? For the Mainstay Services, (a) the databases that store Customer Data are encrypted using the Advanced Encryption Standard and (b) Customer Data is encrypted when in transit between Customer’s software application and the Services using TLS v1.2. Does Mainstay engage in penetration testing? Mainstay performs penetration tests and engages independent third-party entities to conduct application-level penetration tests. Security threats and vulnerabilities that are detected are prioritized, triaged, and remediated promptly. How does Mainstay address vulnerability management? Mainstay maintains controls and policies to mitigate the risk of security vulnerabilities in a measurable time frame that balances risk and the business/operational requirements. Mainstay uses a third-party tool to conduct vulnerability scans regularly to assess vulnerabilities in Mainstay’s cloud infrastructure and corporate systems. Critical software patches are evaluated, tested, and applied proactively. Operating system patches are applied through the regeneration of a base virtual-machine image and deployed to all nodes in the Mainstay cluster over a predefined schedule. For high-risk patches, Mainstay will deploy directly to existing nodes through internally developed orchestration tools. What is your policy for change management? Mainstay has a formal change management process it follows to administer changes to the production environment for the Services, including any changes to its underlying software, applications, and systems. Each change is carefully reviewed and evaluated in a test environment before being deployed into the production environment for the Services. All changes, including the evaluation of the changes in a test environment, are documented using a formal, auditable system of record. A rigorous assessment is carried out for all high-risk changes to evaluate their impact on the overall security of the Services. Deployment approval for high-risk changes is required from the correct organizational stakeholders. Plans and procedures are also implemented in the event a deployed change needs to be rolled back to preserve the security of the Services. What service does Mainstay use for texting? The Mainstay Platform leverages Twilio for SMS communications channels and Twilio SendGrid for email communications. Twilio is certified under ISO/IEC 27001, has attestations to ISO/IEC 27017 and ISO/IEC 27018, and maintains SOC 2 compliance. How does Mainstay respond to a security incident? Mainstay will promptly investigate a Security Incident upon discovery. To the extent permitted by applicable law, Mainstay will notify Customer of a Security Incident in accordance with a relevant Data Protection Addendum. Security Incident notifications will be provided to Customer via email to the email address designated by Customer in its account. Does Mainstay backup customer data? Mainstay performs regular backups of Customer Data, which is hosted on AWS’s data center infrastructure. Customer Data that is backed up is retained redundantly across multiple availability zones and encrypted in transit and at rest using the Advanced Encryption Standard. Mainstay converts to nonprofit and joins Lemnis’ growing portfolio of organizations dedicated to helping learners achieve academic, career and life success Book a call with us: Get a guided tour of Mainstay’s Engagement Platform Mainstay’s Engagement Platform uses Behavioral Intelligence to help businesses build meaningful relationships, optimize insights, and drive action. Sign up for your personalized demo to find out how Mainstay makes it easy to spark conversations with your employees and guide them toward positive results. Channels Instant support — anytime, anywhere Mainstay’s behaviorally intelligent chatbots make it easy to engage with employees on the channels they prefer to use: SMS text messaging Live chat Web chat Social media Get a guided tour of Mainstay’s Engagement Platform Mainstay’s Engagement Platform uses Behavioral Intelligence to help schools and businesses build meaningful relationships, optimize insights, and drive action. Sign up for your personalized demo to find out how Mainstay makes it easy to spark conversations with your students or employees and guide them toward positive results. Channels Instant support — anytime, anywhere Mainstay’s behaviorally intelligent chatbots make it easy to engage with students and employees on the channels they prefer to use: SMS text messaging Live chat Web chat Social media