Information Security

Anti virus

All servers in the hosting environment are protected constantly by Enterprise Grade Anti Virus, regularly patched and updated to ensure full protection.

Disaster recovery

System databases are synchronised in real time to multiple locations to ensure data security and availability. Databases are also backed up at frequent intervals with backups stored in suitable DR locations.

Assets uploaded to the application are backed up every 6 hours.

RPO (Recovery Point Objective) = 6 hours
RTO (Recovery Time Objective = 8 hours

Encryption

All data is encrypted using AES256 while at rest and TLS in transit

Incident management

Detailed incident management policies and procedures are in place to ensure swift resolution to anything which may impact the service of the platform.

Logs

Log data is secured and transferred to a central safe location to protect and ensure integrity of all logged information

Network Security

Networks are secured using multiple controls ensuring only permitted traffic and access. This allows us to protect and manage DDoS, SYN floods, IP fragment floods, port exhaustion, Attack Dispersion and more.

Penetration testing

We conduct an annual penetration test to ensure the platform is robust and secure. This includes tests for hacking, port scanning, cross site scripting and many more.

Results are processed, prioritised and all High and Medium level threats resolved as a matter of urgency.

Software Development Life Cycle (SDLC)

We run a robust agile development process ensuring we cover all key elements in the SDLC including Requirements gathering, Business analysis, Architectural planning, Security planning, Impact analaysis, Code reviews, Testing in secure environments, Phased implementation and Retrospectives to maintain an always learning approach.

Segregation of live data from any development or test environments maintains compete data security.

Vulnerability scanning

Constant vulnerability scanning is handled through our dedicated Security Command Center to ensure we are able to detect and eliminate threats at the earliest opportunity.