Snapshot 4812
Normalized text
Scripts and page chrome removed; this is what change detection compares.
CoLab’s Security Approach Browse through this page to see how we approach everything from cloud hosting to SSO to AI. As always, you can reach out to securityteam@colabsoftware.com with any security concerns or visit CoLab’s trust portal to access critical security documentation. Security FAQs What Cloud providers are used by CoLab? CoLab uses Amazon Web Services (AWS) as the primary cloud provider. Other third party services are used that may store or process customer information. A complete list of third party providers can be found on the subprocessor page of our trust portal. Do you support SSO? Yes, CoLab supports SAML based SSO, which is the preferred method of authentication for CoLab. All standard authentication protocols and identity providers are supported. Where is customer data stored and processed? CoLab uses cloud providers with data centers in Canada and the US for storing and processing customer data. A full list of subprocessors and locations can be found on the subprocessors page of our trust portal. What type of PII is collected by CoLab? CoLab collects a very limited amount of personal information for registered users of the CoLab application and consists of full name (optional), email address (required), and phone number (optional) only. Can CoLab be used for Controlled Goods Data? Yes, CoLab is a registered SaaS provider with the Controlled Goods Program, using AWS Canada as it’s hosting platform. CoLab meets all compliance requirements defined in the Guidance on the use or provision of cloud solutions for controlled goods technical data: https://www.canada.ca/en/public-services-procurement/services/industrial-security/controlled-goods/program-requirements/guidance-using-providing-cloud-solutions.html Does CoLab provide multi-tenant controls for separation of users and data within the service? CoLab uses logical separation for all customer data. Customer uploaded data files use folder level separation in AWS S3 with the necessary authentication, authorization and access controls implemented to ensure that users of the CoLab service can only access their data. Customer data at rest is encrypted in AWS S3 using industry standard encryption, with separate encryption keys per customer. Product Security and Reliability CoLab offers many security features including SAML SSO, robust authentication, and role-based access controls. All these security features are paired with the most secure application model for day-to-day usage by your end users. CoLab customers have control over sharing, downloading, and access permissions at the admin level—ensuring your most valuable assets never land in the wrong hands. SSO CoLab offers, and encourages, SAML Single Sign-on (SSO). This allows customer administrators to authorize user access to CoLab directly from their existing identity provider/SSO solution, with support for all major identity providers. Role-Based Access Control Access to models, drawings, and derivative data is governed by a role-based access control (RBAC) system with user roles at the Company, Workspace and Portal levels. Authentication CoLab uses an industry-recognized, trusted, and secure authentication and authorization service. By providing our customers with a robust solution for user authentication, we help you protect critical identity data. CoLab never stores passwords as clear text—they're always securely hashed and salted using an industry-standard password hashing algorithm. All network communication with CoLab’s authentication and authorization service uses transport layer security (TLS) with advanced encryption standard (AES) encryption. Uptime CoLab has 99.5% or higher uptime Cloud Security CoLab’s security program and its supporting architecture are built on the foundations of ISO 27001/27017/27018, TISAX, SOC 2, FedRAMP and the NIST SP 800-53 (Rev 5) control baseline, and AWS security best practices. In this way, we achieve a level of protection we’re proud to call Security as a Solution. Physical Security and Data Hosting CoLab takes a multidisciplinary approach to security by incorporating application security (AppSec), security operations (SecOps), risk and compliance. Certified pentesters perform regular security assessments and pentesting on our application. CoLab’s Security Team is on call 24/7 to respond to critical security alerts and events. Dedicated Security Team CoLab’s Security Team is on call 24/7 to respond to critical security alerts and events. Intrusion Detection and Prevention CoLab has designed multiple layers of security monitoring to detect anomalous behaviour. When incidents and security events exceed predetermined thresholds, our Security Team is on-duty 24/7 to take immediate action. Logical Access Access to CoLab production infrastructure is restricted on an explicit need-to-know basis, utilizes least privilege, is continuously audited and monitored, and is controlled by a request and authorization process. Employees accessing CoLab production infrastructure are required to use multiple factors of authentication and strict technical and administrative controls. Failover and Disaster Recovery CoLab was built with disaster recovery in mind. Where service support exists, we use no less than two AWS Canada availability zones. Our disaster recovery process and backups are tested a minimum of two times annually. Virtual Private Cloud All CoLab servers are within our own virtual private cloud (VPC). Network access control lists (ACLs) and security groups are properly implemented. Backups All customer data files are backed up in real-time. All data stored within CoLab databases gets backed up every 12 hours, plus immediately before any major product update. Monitoring On an application level, CoLab produces audit logs for all activity and ships logs to a SIEM (security information and event management) service for analysis, using S3 for archival of critical security logs. All actions taken on CoLab’s production infrastructure or AWS services are logged. Permissions and Authentication Access to customer data is strictly limited to authorized privileged employees who require access for their job responsibilities. Encryption All data sent to or from CoLab is encrypted in transit. Our API and application endpoints are TLS/SSL only and score an “A+” rating on Qualys SSL Labs‘ tests. Additionally, all customer data uploaded to CoLab is encrypted at rest using an industry-standard AES-256 encryption algorithm. Pentests and Vulnerability Scanning CoLab uses third-party security tools to continuously scan our codebase for vulnerabilities, addressing applicable vulnerabilities as they are found. Our Security Team includes trained and certified penetration testers who regularly test CoLab’s web application and infrastructure security. Additionally, CoLab engages independent third-party security experts to perform annual detailed penetration tests. Security Incident Response All critical security and system alerts are escalated to CoLab’s Security and DevOps Teams, providing the necessary security operations, network, and infrastructure coverage. Applicable employees are trained on security incident response processes, including communication channels and escalation paths. AI Security Will the data be used to train AutoReview? No, Customer Data will be used only to fine-tune and improve AutoReview for the Customer who provided the Customer Data. How is customer data processed and stored by AI service providers? CoLab has Zero data retention (ZDR) agreements with all AI service providers. Customer data exists only in memory in order to process a request and is not retained. In what ways does your AI incorporate or support human-in-the-loop mechanisms for critical decision-making? CoLab’s AI feature produces data which (1) are suggestions only and (2) has to be reviewed and accepted by a human. The data generated by AutoReview does not get automatically incorporated into a drawing or feedback. Do your AI solutions rely on third-party providers or dependencies? If so, how do you evaluate and secure them? CoLab leverages reputable, industry recognized AI service providers such as Amazon Web Services (AWS), Anthropic, OpenAI, Microsoft Azure, Google Cloud, Cloudflare and Datadog to power CoLab’s AI features and functionality.CoLab uses a rigorous third party review process to evaluate AI providers which includes an assessment of the provider’s security posture and commitments to privacy and data protection. All services and AI models are fully vetted and monitored by our Security team. Application Security CoLab has established extensive processes and controls to ensure application security. Every CoLab developer receives security awareness training and follows common secure development best practices, such as those defined by OWASP. Secure Code Development (SDLC) Developers participate in secure code training which covers the OWASP Top 10 security risks, common attack vectors, and CoLab security controls. CoLab’s development codebase is continuously scanned for vulnerabilities using automated vulnerability scanning. We address all identified vulnerabilities as they are discovered. Framework Security Controls CoLab leverages modern and secure open-source frameworks with security controls to limit exposure to OWASP Top 10 security risks. These inherent controls reduce our exposure to SQL Injection (SQLi), Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), and other common vulnerabilities. Quality Assurance Our Quality Assurance (QA) Team continuously reviews and tests our codebase. Dedicated, on-staff penetration testers regularly test for security vulnerabilities in our application code and infrastructure. Separate Environments Testing and staging environments are logically separated from the production environment. No customer data is used in our development or test environments. HR Security At CoLab we ensure that our employees adhere to the highest security standards by implementing extensive employee background checks and administrative controls. Training All employees complete Security Awareness training during onboarding and continually refresh their training. Policies CoLab has developed a comprehensive set of security policies based on NIST, SOC 2, and ISO 27001. These policies are updated as needed, reviewed annually, and communicated clearly to all employees. Employee Screening CoLab performs comprehensive background checks on all new employees as a condition of employment. The background check includes federal and local criminal background checks, as well as employment verification and reference checks. Confidentiality All employee and third-party contracts include a confidentiality agreement. Compliance CoLab has built its information protection and cybersecurity program from the ground up to meet the highest bar in commercial and government security — and to earn customer trust. We continuously improve our protection and detection controls, track evolving industry standards, and respond to a changing threat landscape. CoLab completes an annual SOC 2 Type 2 audit, continuously achieving a clean report with zero findings. We hold ISO 27001, ISO 27017, and ISO 27018 certifications, reflecting our commitment to internationally recognized standards for information security management, cloud security, and the protection of personally identifiable information in the cloud. CoLab has also achieved TISAX, demonstrating our ability to handle highly sensitive automotive industry information in accordance with the ENX Association's rigorous requirements. CoLab is Certified at the FedRAMP High impact level, meaning our service has been assessed against the NIST SP 800-53 (Rev 5) control baseline required for U.S. federal agencies. You can view our listing on the FedRAMP Marketplace. CoLab Software is also registered in the Government of Canada’s Controlled Goods Program (CGP), reflecting our commitment to protecting our customers’ most sensitive intellectual property across both U.S. and Canadian regulatory regimes. Privacy and Terms of Service For more information on our approach to privacy, or to view the detailed CoLab Terms and Conditions, see here: privacy at colabCoLab Terms and Conditions Security Concern? We’re meticulously proactive about security and keeping your data safe. But if you have any questions or concerns, we take each one seriously. Please email securityteam@colabsoftware.com to talk to our Security Team.