• Data is encrypted both in transit and at rest using AWS Key Management Service.

• We have a variety of data privacy policies, click here (this should be to email us) to learn more

• We rely on multiple AWS features such as Amazon S3 for secure data storage, EC2 for compute power, and RDS for database management.

Our incident response process is a systematic approach to identifying, addressing, and resolving security incidents to protect our users and maintain platform integrity. It begins with detection and monitoring, where tools such as AWS CloudTrail, AWS Config, and Amazon CloudWatch are utilized to continuously scan for suspicious activity, anomalies, or potential security breaches. These tools provide real-time alerts and logs, enabling the team to swiftly recognize potential threats before they escalate. Once an incident is detected, the assessment phase evaluates its severity, scope, and potential impact, helping prioritize response efforts based on criticality.

The process then moves into containment, eradication, and recovery. Containment involves immediate actions to prevent the incident from spreading, such as isolating compromised systems, revoking access credentials, or blocking malicious traffic. During eradication, the root cause of the issue is identified and eliminated, whether it’s removing malware, patching vulnerabilities, or addressing insider threats. The final recovery step ensures the safe restoration of affected systems, verifying their integrity and returning them to normal operations. A post-incident review follows to analyze lessons learned, improve security processes, and reduce the risk of recurrence. Communication throughout the process is a priority, with relevant stakeholders and, when applicable, users and regulatory bodies being informed promptly and transparently.

Our employee training programs are designed to instill a culture of security awareness and equip team members with the skills to proactively address evolving threats. Secure coding practices are a core focus, with developers trained on topics such as input validation, output encoding, session management, and error handling. Regular workshops and code reviews emphasize the importance of adhering to industry best practices and secure coding standards to prevent vulnerabilities such as SQL injection and cross-site scripting (XSS). Developers also learn to leverage automated tools for static and dynamic code analysis, ensuring security is integrated at every phase of the software development lifecycle.

Training extends to data protection and phishing prevention for all employees. Sessions highlight best practices for handling sensitive information, recognizing and reporting potential phishing attacks, and avoiding social engineering traps. Employees participate in hands-on simulations, such as phishing email exercises, to hone their ability to identify suspicious communications. Regular updates and refresher courses keep team members informed about the latest security trends and tactics used by attackers. This holistic approach ensures every employee is a proactive participant in safeguarding the organization’s data and systems.