Security & Privacy Policy

This document describes technical and organisational security measures and controls implemented by IP Sentinel Services (‘IPSS‘) to protect the data customers entrust to us as part of the IPSS service.

Within this document, the following definitions apply:

‘Customer’ means any subscriber to the IPSS service.
‘IPSS Service’ means the solution provided by IPSS to our Customers.
‘Customer Data’ means any information provided or submitted by the Customer that is processed by the IPSS service.
‘Personal Data’ means any information relating to an identified or identifiable natural person.
‘Personnel’ means IPSS employees and authorised individual contractors/vendors.
‘Strong Encryption’ means the use of industry standard encryption measures.
‘Cloud Service Provider’ means a service provider such as Amazon Web Services, Google Cloud, Elastic Cloud, Azure, Python Anywhere, GitHub.com, Atlassian

This document is a high-level overview of IPSS’s technical and organisational measures.

IPSS may change these measures from time to time to adapt to the evolving security landscape and where required will notify customers of these changes.

Organisation of Information Security

Objective:  To outline IPSS’s information security structure.

Measures include:

  • IPSS has a comprehensive set of information security policies, approved by senior management and disseminated to all Personnel.
  • All IPSS Personnel have signed legally reviewed confidentiality agreements.
  • All IPSS Personnel are given training in information security.

Physical Access

Objective:  To protect the physical assets that contain Customer Data.

Measures include:

  • The IPSS Service operates from several industry certified third-party Cloud Service Providers which all have a defined and protected physical perimeter, strong physical controls including access control mechanisms, controlled delivery and loading areas, surveillance, and security guards.
  • Each Cloud Service Provider is assessed for compliance to IPSS security controls.
    • Power and telecommunications cabling carrying Customer Data or supporting information services at the production data centers are protected from interception, interference and damage.
  • The production data centers and their equipment are physically protected against natural disasters, unauthorized entry, malicious attacks, and accidents.
  • Equipment at the production data center is protected from power failures and other disruptions caused by failures in supporting utilities, and is appropriately maintained.

System Access

Objective:  To ensure systems containing Customer Data are used only by approved, authenticated users.

Measures include:

  • Access to IPSS systems is granted only to IPSS Personnel and/or to permitted employees of IPSS’s subcontractors and access is strictly limited as required for those persons to fulfil their function.
  • All users access IPSS systems with a unique identifier (UUID) and multi factor authentication.
    • IPSS has established a password policy that prohibits the sharing of passwords and requires passwords to be changed on a regular basis and default passwords to be altered. All passwords must fulfil defined minimum complexity requirements and are stored in encrypted form.
  • Access to systems containing Customer Data are only possible from restricted IP addresses and require a multi factor authentication.
  • IPSS has a comprehensive process to deactivate users and remove their access when Personnel leaves the company or moves between functions internally.
  • All access or attempted access to systems is logged and monitored.

Data Access

Objective: To ensure Personnel entitled to use systems gain access only to the Customer Data that they are authorised to access.

Measures include:

  • As a matter of course, IPSS Personnel do not access Customer Data and where access is required to operate the service or assist in a customer issue, the request for access must be formally justified/tracked and approved by the customer.
  • IPSS restricts Personnel access to Customer Data on a “need-to-know’ basis based on this justification.
    • Each such access and its subsequent operations are logged and monitored.
  • Personnel training covers access rights to, and general guidelines on, definition and use of Customer Data.

Data Transmission/Storage/Destruction

Objective: To ensure Customer Data is not read, copied, altered or deleted by unauthorised parties during transfer/storage.

Measures include:

  • Customer access to the IPSS Service portals are protected by the most current version of Transport Layer Security (TLS).
  • IPSS uses Strong Encryption in the transmission of Customer Data within the Cloud Service Providers services.
  • Each Customer is assigned a Strong Encryption key and that key is used:
    • To encrypt Customer Data and store it in an encrypted format at rest within the IPSS Service.
    • To decrypt Customer Data when requested as part of the service.
  • Upon Customer’s request, Customer Data will be promptly deleted.
    It should be noted that with each deletion request, the Customer Data is logically deleted in the first storage copy and then completely deleted across the other copies. This is done in order to prevent accidental deletions or possible intentional damage.
  • Cloud Service Providers equipment or disk media containing Customer Data are not physically removed from the production data center unless securely erased prior to such removal or being transferred securely for destruction at a third-party site.

Confidentiality and Integrity

Objective:  To ensure Customer Data remains confidential throughout processing and remains intact, complete and current during processing activities.

Measures include:

  • IPSS has a formal background check process and carries out background checks on all new Personnel.
  • IPSS trains its engineering Personnel in application security practices and secure coding practices.
    • IPSS has a central, secured repository of product source code, which is accessible only to authorised Personnel.
  • IPSS has a formal application security program and employs a robust Secure Development Lifecycle (SDL).
  • Security testing includes code review, penetration testing, and employing static code analysis tools on a periodic basis to identify flaws.
  • All changes to software on the IPSS Service are via a controlled, approved release mechanism within a formal change control program.
    • All encryption and other cryptographic functionality used within the IPSS Service uses industry standard encryption and cryptographic measures.

Availability

Objective: To ensure Customer Data is protected from accidental destruction or loss, and there is timely access, restoration or availability to Customer Data in the event of a service incident.

Measures include:

  • IPSS uses a high level of redundancy when storing Customer Data. Customer Data is stored in triplicate across two different Cloud Service Providers
  • Each Cloud Service Provider can be failed-over/back to another geographical region in the event of flooding, earthquake, fire or other physical destruction or power outage to protect Customer Data against accidental destruction and loss.
    • Each production Cloud Service Provider has multiple geographical regions, power supplies, generators on-site and with battery back-up to safeguard power availability.
  • Each production Cloud Service Provider has multiple access points to the Internet to safeguard connectivity.
  • Each production Cloud Service Provider is monitored 24x7x365 for availability, connectivity and technical issues.
  • IPSS maintains a robust Business Continuity/Disaster Recovery program including
    • Well defined and regularly updated plans.
    • Regular Testing and remediation.

Data Separation

Objective: To ensure each Customer’s Data is processed separately.

Measures include:

  • IPSS uses logical separation within its multi-tenant architecture to enforce data segregation between customers.
  • In each step of the processing, Customer Data received from different Customers is assigned a unique identifier so data is always physically or logically separated.
    • Customers only have access to their own Customer Data through the use of their own UUID and authentication key.

Incident Management

Objective: In the event of any security breach of Customer Data, the effect of the breach is minimised and the Customer is promptly informed.

Measures include:

  • IPSS maintains an up-to-date incident response plan that includes responsibilities, how information security events are assessed and classified as incidents and response plans and procedures.
  • IPSS regularly tests its incident response plan with ‘table-top’ exercises and learns from tests and potential incidents to improve the plan.
    • In the event of a security breach, IPSS will notify Customers without undue delay after becoming aware of the security breach.

Audit

Objective: To ensure IPSS regularly tests, assesses and evaluates the effectiveness of the technical and organisational measures outlined above.

Measures include:

  • IPSS conducts regular internal and external audits of its security practices.
  • IPSS ensures that Personnel are aware of and comply with the technical and organisational measures set forth in this document.