Snapshot 72468
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Joopy Security Overview
joopy.com uses world-leading security solutions to secure our service so your data can be kept safe.
Overview
joopy.com serves tens of thousands of users around the world. We understand that our customers expect us to
protect their data with the highest standards and are committed to providing them with a highly secure and
reliable environment. Our security model and controls are based on international standards and industry best
practices, such as ISO 27001 and OWASP Top 10.
Architecture
How do we secure your data?
Our systems are hosted at Amazon Web Services. This allows us to provide a reliable service and keeps
your data available whenever you need it.
These data centers employ leading physical and environmental security measures, resulting in highly
resilient infrastructure. For more information about their security practices, see below:
AWS security page
1|P a g e Joopy Security Overview
v5.docx(2.0)
Application Security
Joopy implements a security-oriented design in multiple layers, one of which is the application layer. The
application is developed according to the OWASP Top 10 framework and all code is peer reviewed prior
to deployment to production.
Infrastructure Security
Another layer of security is the infrastructure. As stated Joopy.com is hosted at AWS.
Furthermore, our infrastructure is protected using multiple layers of defense mechanisms, including:
• Firewalls for enforcing IP whitelisting and access through permitted ports only to network resources
(AWS ip group restrict)
• A web application firewall (WAF Amazon) for content-based dynamic attack blocking
• DDoS (Denial of Service) mitigation and rate limiting - AWS Shield
• Monitoring and management service - collects monitoring and operational data - CloudWatch
• Comprehensive logging of network traffic, both internal and edge
Database Access
Database access is restricted and closed under VPC (Amazon Virtual Private Cloud ) and Security group,
there is no public end point.
Data Encryption
joopy.com encrypts all data both in transit and at rest:
Traffic is encrypted using TLS 1.3 with a modern cipher suite, supporting TLS 1.2 at minimum
User data is encrypted at rest across our infrastructure using AES-256 or better
Credentials are hashed and salted using a modern hash function
Physical Security
joopy.com is a cloud-based company, with no part of our infrastructure retained on-premise. Our
physical security in the offices include personal identification-based access control.
joopy.com’s data centers are hosted on Amazon Web Services infrastructure a leading physical security
measures are employed.
2|P a g e Joopy Security Overview
v5.docx(2.0)
Disaster Recovery and Backups
joopy.com is committed to providing continuous and uninterrupted service to all its customers. All
backups are encrypted and retained for 30 days.
Our Disaster Recovery Plan is tested at least twice a year to assess its effectiveness and to keep the
teams aligned with their responsibilities in case of a service interruption.
Access Control
We know the data you upload to joopy.com is private and confidential. We regularly conduct user
access reviews to ensure appropriate permissions are in place, in accordance with the least privilege
principle. Employee’s access is permitted only by VPN access using MTA Google services.
Employees have their access rights promptly modified upon change in employment.
PRIVACY
As part of our company's commitment to privacy, we never transfer personal information from our
customers to any third parties that are not required to process the information (E.g. AWS), and certainly
not to external parties that can use it for marketing, for example. Information will only be used as
agreed in the contract.
3|P a g e Joopy Security Overview
v5.docx(2.0)
Question and Answers
1. How does joopy.com secure its users’ access into the joopy.com service?
Access into joopy.com is performed via the following authentication methods:
Credentials: username (usually your email address) and password;
We also support the use of external identity providers, such as Azure Active Directory and Okta,
OneLogin and custom SAML 2.0.
2. Does joopy.com support the configuration of password policies?
We provide administrators with a choice of two passwords strength settings for their account:
• 8 characters minimum with no repeating or consecutive characters allowed
• 8 characters minimum with no repeating or consecutive characters allowed and an
inclusion of at least one digit (123),one lowercase letter (abc) and one uppercase letter
(ABC).
• we allow also customize password policy upon request.
3. Where are joopy.com’s data centers located?
joopy.com is a fully cloud-based service. Our service is hosted on Amazon Web Services
infrastructure in Ireland and the US ( California ).
These data centers employ leading physical and environmental security measures, resulting in
highly resilient infrastructure.
More information about their security practices is available at:
AWS security page
4. How do you ensure your service’s availability?
Enterprise customers are provided with a 99.9% SLA, subject to terms of the SLA. Additionally,
our service's availability can be monitored.
Before any downtime ( upgrade / scheduled maintenance ) an email will be send to the
customer.
5. Which Security and Privacy related regulations, standards and certifications does joopy.com
comply with as of the date hereof?
We have the following certifications, reports and compliance programs:
ISO 27001
ISO 27018
GDPR
4|P a g e Joopy Security Overview
v5.docx(2.0)
6. How long does joopy.com retain my data? What happens to it if I stop using the service?
joopy.com customers retain full control of their uploaded data and may
modify or delete it at all times during their subscription term - using the means
available to them through joopy.com 's user interface.
You can request deletion of your data as part of the account closure
procedure. All your submitted data will then be deleted within 90 days, which includes a 30-day
period to allow for rollback, and additional 60 days to delete the data from
our databases.
Alternatively, you may opt to keep your account's data even after you close
your account and cancel your subscription, in which case our current policy is
to retain it but without commitment to a specific duration. In such cases, we
may delete it with or without notice.
7. Does joopy.com provide audit logs of user activity in the platform?
Yes, logs can be viewed and download via dedicated application screen we provided in two
forms:
1. Changes in the Data can be viewed and download
2. Login / Logout and access control changes per user information.
8. Is the joopy.com service available in an on-premise version?
joopy.com can offer private / on-premise version of its service.
9. How often is data backed up?
We are consistently backup user data daily, where they are
retained for 30 days. We have also established a disaster recovery site in a
separate AWS region.
10. Does joopy.com have a Disaster Recovery Plan?
Yes. Our DRP deals with disasters affecting our production environment and
includes the restoration of the service's core functionality from our dedicated
DR location. Testing is conducted at least twice a year.
11. How do you ensure your service’s availability?
customers are provided with a 99.9% SLA, subject to terms of the
SLA, using AWS CloudWatch monitor tool.
In case the system is down the customer will not be able to access his data or load additional
information, no data is lost during this time.
5|P a g e Joopy Security Overview
v5.docx(2.0)
12. How will joopy.com inform me if an incident or a breach have compromised my personal
data?
The format would depend on the type, scope and scale of the incident, though at minimum it
will include an email sent to your account administrator(s). You would be informed to the extent
available of the nature of the breach, the harmful effects of which joopy.com is aware, and the
actions joopy.com has taken and plans to take. we will notify you within 24 hours event occurs.
In addition, if an authority requests your information, we will contact you about it
13. How do we communicate information security events to our customers?
If an information security event occurs related to your data, beyond a professional team that
will handle it, we will make sure to notify you within 24 hours.
14. How will Joopy.com monitor data loaded into the application ?
Loading data into the application is done via a dedicated console application that has a secure
connection to the server and verify the integrity and content of the file.
15. How often will Joopy.com site is upgraded?
Joopy.com update is done according to the closing of new versions (usually quarterly).
There are separated instances for development, testing and production,
During the upgrade, the system is down for the duration of ~1h, over the weekend,
and the upgrade is done in coordination with the customer.
6|P a g e Joopy Security Overview
v5.docx(2.0)