Security Features

Information Risk Assessment:

We have implemented and/or assessed the following points to ensure information security:

1. Role-based access / authorization: We have verified through different use cases that one user is unable to access data of another user, regardless of roles. This same delineation of access exists between different organizations.

2. Registration process: We have made the registration process semi-automated. That is, all user types must be invited by another user with administrative privileges. Nobody from outside the network can simply register and use the system.

3. User login failure messages: If a user fails to log in with the correct credentials, our system does not reveal whether the user exists. This ensures that account usernames/emails are not guessable.

4. Password policy: We require complex passwords for new users. We have put in place a policy that requires all users to change passwords every six months.

5. File access: We store all files over cloud servers using Amazon Web Services (AWS), which are only accessible in the following ways:

   1. Via direct console login on AWS - Only our two lead programmers and our cofounders have this access.

   2. Via the application - Each user can only delete files that he/she has previously uploaded himself/herself.

6. Developed on RoR: Our web application framework is developed on Ruby on Rails (RoR). By default, use of Rails results in certain security measures, such as cross-site scripting, sessions and cookies, and secure parameters in the request.

Third Party Penetration/Vulnerability Scans:

We are continually conducting penetration testing to ensure that our security meets expectations. We have a third party QA specialist who can produce a complete penetration testing report within 8-10 business days. Please let us know if this will be necessary.

Disaster Recovery Plan:

As of now, the structure of our disaster recovery plan is as follows:

1. Codebase residence: The codebase resides on AWS cloud server, which is one of the most secure storage services in the industry.

2. AWS server enhancements: Through AWS, we have invested further in our cloud server by implementing “versioning” to ensure that nothing is deleted at any given point in time.

3. Codebase audit: We performed a full audit of the codebase to verify any required changes to security, such as SQL DB queries, request authorization, etc.

   1. As a result of the audit, we implemented CanCanCan, the authorization Gem for Ruby on Rails.

4. Deployment server: The deployment server also resides on a widely used, industry-standard cloud platform.

   1. This is accessible via verified SSH only.

      1. For verification, end users’ SSH keys need to be added to their web application first, and then someone can use it via SSH.

   2. As an additional step, we have scheduled backups of the database.

Business Insurance:

Covered by $1,000,000 of professional liability/E&O insurance coverage