Snapshot 6445
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Schedule a Demo Trust and compliance at Mend.io Mend.io’s information security leadership conducts regular risk assessments to constantly evaluate and improve the level of information security based on business needs and emerging threats. Mend.io’s information security management program is evaluated by the senior management security committee on a quarterly basis. At Mend.io, we understand that the security of your data and privacy is of utmost importance. As a leading Application Security company, we prioritize the protection and confidentiality of your sensitive information. This page provides an insight into our robust security measures, ensuring that your data is in safe hands. Compliance ISO 27001 At Mend.io, we have established an integrated information security management system incorporating controls for ISO 27001, ISO 27017, and ISO 27701. These controls are reviewed externally every year. SOC 2 Type II Mend.io’s controls are evaluated by Schellman, a firm specializing in annual compliance assessments across various industries. Our reporting period spans from May to June of the subsequent year. You can request a copy of this report through your account team. GDPR At our company, headquartered in Israel with operations spanning the EU, US, and worldwide, we are committed to the highest standards of privacy and data protection. Our compliance with the General Data Protection Regulation (GDPR), as well as other applicable data protection laws in the US, to which we are subject, ensures we meet stringent privacy requirements. We have established robust internal policies as well as our publicly available Privacy Policy to maintain GDPR compliance and to handle data subjects’ requests concerning their data, demonstrating our dedication to protecting their privacy. To enhance data protection, we have implemented technical and organizational measures to minimize personal data processing and ensure that only necessary data is processed. In particular, we pseudonymize the email addresses of our customers’ contributing developers using encrypted email addresses through hashes. Additionally, we have partnered with TrustArc as our Dispute Resolution Service Provider for unresolved privacy concerns data subjects’ may have, adding an extra layer of trust and transparency. It satisfies the Independent Recourse Mechanism requirement for the EU-US Data Privacy Framework, which includes coverage for both Swiss-US and UK Extension. Further information on how we handle your personal data, the way we use it and your rights, may be found in our online Privacy Policy. Vulnerability disclosure program At Mend, we take security seriously. We encourage responsible disclosure of potential vulnerabilities to help keep our systems safe. If you believe you’ve discovered a security issue, please report it to us through our Vulnerability Disclosure Program. We will investigate all valid reports and respond promptly. Social and environmental commitments Mend.io holds Social and Environmental commitments which ensure we are focused on addressing problems for our stakeholders and communities. Our commitment to positively impact society and communities can be found on our Impact page here. Public documents Compliance & accreditation overview Information security policy Request security documents Continuously monitored controls Applications Common web vulnerabilities Cryptography Dependency vulnerability monitoring Encryption documentation Open source licensing Source control Static code analysis Customers Audit trail Documentation site Master services agreement Privacy policy Product security controls Release notifications Support channel System status Terms of use Physical Security Badge access system Badge access system admins Clear desk policy Equipment room Office access Remote working security Surveillance cameras Visitor access IT Infrastructure Acceptable use Asset disposal Asset types Bring your own device (BYOD) policy Data loss prevention Email protection Information and communication technology (ICT) recovery plan and test Inventory Mobile device management Mobile device policy Passwords encryption Remote access Secure system configurations System inventory Workstations – OS Workstations – malware People Background checks Board oversight Board of directors Company employees meeting Confidentiality agreement Cyberattack simulation Disciplinary process Employee handbook/Code of conduct Employee performance reviews Hiring process Job descriptions Organizational structure Policy acknowledgement Role-based training Security awareness training Security officer Simulated Phishing Attacks Termination process Training program Identity and Access Control Administrative access Automatic logoff for systems Company confidential systems access review Company restricted systems access review Customer confidential systems access review Least-privilege access Multi-factor authentication (MFA) Password configurations Requesting and approving access Role-based access control Single sign-on (SSO) User access review Data Data disposal Data handling Data retention Data classification Data in transit encryption Data store encryption File store encryption Information sharing Key management Non-production data Privacy Complaints handling Data anonymization and de-identification Data erasure request Data protection/Privacy officer Geolocation of data storage and processing Personal data collection purposes Personal data corrections Privacy notices Privacy training Cloud Infrastructure Cloud services evaluation Data centers Fault tolerance Firewalls Infrastructure-as-code Intrusion detection Malware detection Network segmentation Patch management Penetration testing TLS certificates and endpoints Time synchronization VPN Vulnerability scanning Web application firewall Monitoring Audit logging Centralized logging Continuous monitoring File integrity monitoring Logging of administrative actions Security event logging Security event review Unauthorized access monitoring Usage monitoring Other Controls Business continuity and disaster recovery policy Cloud service provider documented responsibilities Intellectual property rights Preservation of information Vendors Inventory and classification Vendor agreements Vendor monitoring Vendor off-boarding Vendor risk assessment Product Delivery Process Agile process Backup plan Backup retention Backup storage Backup system monitoring Capacity planning Change management approvals Change management tooling Change management tracking Change management workflow Emergency changes Internal support channel Production change notifications Production deployment access Quality control process Restore testing SDLC – security reviews SDLC – separation of environments Secure coding practices Business Operations Process Access policy Asset management policy Audit logging and monitoring Breach notification Business continuity/disaster recovery program Compliance management tool Continual improvement Control reviews Control selection Corrective action tracker Corrective actions Cyber insurance Data retention and disposal policy Disaster recovery testing External assessments Human resources policy ISMS context of the organization ISMS scope Incident communication Incident response team Information security management system Information security objectives Information security policy Information security in project management Interested parties Internal assessments Management review program Physical security policy Policy management Procedure creation Risk assessment Risk management Security incident – change management Security incident – testing Security incident – tracking Security incident management program Security team meetings Security and compliance updates Separation of duties Statement of applicability Technology control Threat intelligence procedure Vendor management policy Vulnerability management policy