Compliances
Physical Security
Our servers are hosted in the Google Cloud Infrastructure in the United States. Google Cloud provides an advanced set of access, encryption, and logging features. Google Cloud is trusted by world’s top brands and has more than 1 million customers. They have multiple layers of operational and physical security in place to ensure the integrity and safety of your data.
Google Cloud infrastructure consists of multiple, discrete data centers, each with redundant power, networking and connectivity, housed in separate facilities. This enables us to run production applications and databases which are more highly available, fault tolerant and scalable than would be possible from a single data center.
Network & System Security
Our applications is built on solutions by Google Cloud like Cloud Run, Cloud SQL and Cloud Storage. What this means is that it is Google Cloud that manages the network and other infrastructure. Our servers are automatically scalable depending on the traffic. Pus, they are regional, automatically replicated across multiple zones.
Our database is based on multiple levels of security. These include network isolation, encryption at rest using 256 bit keys and encryption of data in transit using SSL. Data in the underlying storage is encrypted, as are the automated backups, snapshots, and replicas.
Data-at-rest and data-in-transit between hosts and volumes is protected with 256 bit key encryption. All backups are also encrypted.
Application Security
We deploy strict in-house security requirements and policies during our application development lifecycle. We use libraries only from well-known and trusted sources. There is an in-depth security review of the architecture. We also conduct regular manual assessment and dynamic scanning of our pre-production environments.
All user passwords are stored as a one-way salted hash and cannot be accessed by anyone. We also enforce strict user password policies to enhance data security. Current we require a password with at least eight characters in length and it must also have at least one uppercase, numeric and special character.
Login attempts are also restricted to prevent brute-force hacking.
We have role-based in-application security mechanisms ensure that data access and user actions can be limited by each user’s role in each project. These individual user rights are controlled and managed by account administrators.
Organizational Security
Access to our servers and the data stored in our databases is limited only to key members of the company. There are stringent security policies for employee access, and all accesses are logged and monitored. All our employees are bound by the confidentiality agreement and accessing any customer data is only done on an as-needed basis only.
Disaster Recovery & Availability
Our entire application is built on top of Google Cloud services in the multi-region mode which means we are automatically protected against disasters or physical storage failures as data is copied to multiple locations. Our servers are set to automatically scale which means Google Cloud will automatically add more servers when needed.
We use Google Cloud SQL service as our database. This makes it possible for us to recover data even from developer errors using their point-in-time recovery (PITR) capability.
Got questions or have any concerns?
Please contact our security team 24x7 at [js em address]