Security & Compliance

Last Updated on October 17, 2019

Security and compliance are top priorities for Apozy because they are fundamental to your experience with the product. Apozy is committed to securing your application’s data, eliminating systems vulnerability, and ensuring continuity of access.

Apozy uses a variety of industry-standard technologies and services to secure your data from unauthorized access, disclosure, use, and loss. All Apozy employees undergo background checks prior to employment and are trained on security practices during company onboarding and on an annual basis.

Security is directed by Apozy’s Chief Executive Officer and maintained by Apozy’s team.

Vulnerability Disclosure

If you would like to report a vulnerability or have any security concerns with a Apozy product, please contact security@apozy.com.

Include a proof of concept, a list of tools used (including versions), and the output of the tools. We take all disclosures very seriously. Once disclosures are received, we rapidly verify each vulnerability before taking the necessary steps to fix it. Once verified, we periodically send status updates as problems are fixed.

Compliance and Certification

GDPR

If you are dealing with any European Union data through a vendor (like Apozy), then you need a contractual agreement in place with each vendor so the EU knows you’re only doing business with companies that fully comply with the GDPR. Apozy’s Data Processing Addendum (DPA) is available upon request.

In an effort to exceed the requirements of GDPR and provide the same privacy benefits to all our users, Apozy applies the standards of the regulation globally, instead of limiting its scope to Europe. All customer data (and all our marketing data) is treated in a way that conforms with GDPR.

You may submit a GDPR request to Apozy at any time by emailing rick@apozy.com.

HIPAA and HITECH

Apozy data is hosted on Amazon Web Services and Google Cloud Platform, which encrypts all data at rest by default, in compliance with the Privacy Rule within HIPAA Title II. Apozy also exercises strong access control and technical and administrative safeguards in compliance with HIPAA’s Security Rule.

Apozy can sign a Business Associate Agreement (BAA) with Enterprise customers who require data services to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA), amended by the Health Information Technology for Economic and Clinical Health Act (HITECH).

PCI DSS

Apozy’s payment and card information is handled by Stripe, which has been audited by an independent PCI Qualified Security Assessor and is certified as a PCI Level 1 Service Provider, the most stringent level of certification available in the payments industry.

Apozy does not typically receive credit card data, making it compliant with the Payment Card Industry Data Security Standards (PCI DSS) in most situations. Apozy can also automatically scrub data that looks like credit card information via its Data Scrubber feature, which is enabled by default.

Privacy Shield

For information that we receive from the European Union, Apozy has certified its compliance with the EU-U.S. Privacy Shield as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information from European Union countries and Switzerland. We have certified that we adhere to all key Privacy Shield Principles when transferring and processing personal information from the EU in the U.S.:

* Notice
* Choice
* Accountability for Onward Transfer
* Security
* Data Integrity & Purpose Limitation
* Recourse, Enforcement & Liability

Infrastructure and Network Security

Physical Access Control

Apozy is hosted on the Amazon Web Services(AWS) and the Google Cloud Platform. Amazon and Google data centers feature a layered security model, including extensive safeguards such as:

* Custom-designed electronic access cards
* Alarms
* Vehicle access barriers
* Perimeter fencing
* Metal detectors
* Biometrics

According to the Google Security Whitepaper: “The data center floor features laser beam intrusion detection. Data centers are monitored 24/7 by high-resolution interior and exterior cameras that can detect and track intruders. Access logs, activity records, and camera footage are reviewed in case an incident occurs. Data centers are also routinely patrolled by professional security guards who have undergone rigorous background checks and training.”

Apozy employees do not have physical access to Google or Amazon data centers, servers, network equipment, or storage.

Logical Access Control

Apozy is the assigned administrator of its infrastructure on AWS and Google Cloud Platform, and only designated authorized Apozy operations team members have access to configure the infrastructure on an as-needed basis behind a two-factor authenticated virtual private network. Specific private keys are required for individual servers, and keys are stored in a secure and encrypted location.

Third-Party Audit

AWS and Google Cloud Platform undergo various third-party independent audits on a regular basis and can provide verification of compliance controls for its data centers, infrastructure, and operations. This includes, but is not limited, to SSAE 16-compliant SOC 2 certification and ISO 27001 certification.

Intrusion Detection and Prevention

Unusual network patterns or suspicious behavior are among Apozy’s biggest concerns for infrastructure hosting and management. Google Cloud Platform’s intrusion detection and prevention systems (IDS/IPS) rely on both signature-based security and algorithm-based security to identify traffic patterns that are similar to known attack methods.

IDS/IPS involves tightly controlling the size and make-up of the attack surface, employing intelligent detection controls at data entry points, and developing and deploying technologies that automatically remedy dangerous situations, as well as preventing known threats from accessing the system in the first place.

Apozy does not provide direct access to security event forensics, but does provide access to the engineering and customer support teams during and after any unscheduled downtime.

Business Continuity and Disaster Recovery

High Availability

Every part of the Apozy service uses properly-provisioned, redundant servers (e.g., multiple load balancers, web servers, replica databases) in the case of failure. As part of regular maintenance, servers are taken out of operation without impacting availability.

Business Continuity

Apozy keeps weekly encrypted backups of data in multiple regions on AWS and Google Cloud Platform. While never expected, in the case of production data loss (i.e., primary data stores lost), we will restore organizational data from these backups.

Disaster Recovery

In the event of a region-wide outage, Apozy will bring up a duplicate environment in a different Google Cloud Platform region. The Apozy operations team has extensive experience performing full region migrations.

Data Flow

Data into System

The Apozy browser extension securely send events, containing information on errors and incidents, to the Apozy server, which processes and stores the events. Audit data of processing and storing is transmitted to our in-house logging infrastructure through encrypted connections.

Apozy provides documentation outlining configurations to filter out bits of data for security and privacy purposes, but that otherwise delivers the rest of the event data intact. Scrubbing the following values is recommended:

* Values where the keyname matches password, passwd, or secret
* Values that match the regular expression of r'^(?:\d[ -]*?){13,16}$' (credit card-like)
* Authentication header (HTTP)

Data through System

Data is sent securely to Apozy via TLS to an HTTPS endpoint. All data is AES-256bit encrypted, both in transit and at rest. Apozy aggregates events along with contextual data related to the user’s environment and preceding events.

Data out of System

Once the event is processed, it can then be accessed via Apozy’s user interface and REST APIs. Apozy integrates with a variety of third-party tools so developers can combine security incident data from Apozy with data from other systems, manage workflows efficiently, and be alerted of incidents through notification and chat tools, in addition to email and SMS. Therefore, Apozy’s high standards for security and compliance also extends to its partner network.

Data Security and Privacy

Data Encryption

All data in Apozy servers is automatically encrypted at rest. AWS and Google Cloud Platform stores and manages data cryptography keys in its redundant and globally distributed Key Management Service. So, if an intruder were ever able to access any of the physical storage devices, the Apozy data contained therein would still be impossible to decrypt without the keys, rendering the information a useless jumble of random characters.

Encryption at rest also enables continuity measures like backup and infrastructure management without compromising data security and privacy.

Apozy exclusively sends data over HTTPS transport layer security (TLS) encrypted connections for additional security as data transits to and from the application.

Data Retention

Apozy retains event data for 90 days by default, regardless of plan. We remove individual events after 90 days, and we remove aggregate issues after 90 days of inactivity. All event data and most metadata is eradicated from the service and from the server without additional archiving in order to prevent the threat of intrusion.

Data Removal

All customer data stored on Apozy servers is eradicated upon a customer’s termination of service and deletion of account after a 24-hour waiting period to prevent accidental cancellation. Data can also be deleted upon request and via Apozy’s REST API and UI.

Users have the ability to remove individual events via bulk delete of all events within an issue and can permanently remove data related to a given tag.

PII Scrubbing

To mitigate accidents and other security risks, Apozy offers server-side filtering as a default setting. The Data Scrubber option in Apozy’s settings ensures PII doesn’t get sent to or stored on Apozy’s servers, automatically removing any values that look like they contain credit cards (using a basic regular expression) or private keys (PEM) and keys that contain any of the following values:

* password
* secret
* passwd
* authorization
* api_key
* apikey
* access_token

Application Security

Two-Factor Authentication

In addition to password login, two-factor authentication (2FA) provides an added layer of security to Apozy via a time-based one-time password algorithm (TOTP). We encourage 2FA as an important step towards securing data access from intruders. Apozy users can deploy universal second factor devices like YubiKeys (which can also be used to confirm the sudo prompt), TOTP apps like Google Authenticator, or SMS as second factors. This also applies to sign-in with an SSO provider.

Apozy’s organization list also displays who has 2FA enabled so users can vet their own organization’s security.

Single Sign-On

Apozy’s single sign-on (SSO) implementation prioritizes security. We aggressively monitor linked accounts and will disable them with any reasonable sign that the account’s access has been revoked. SSO also improves user experience by streamlining login and improving access from trusted domains. Apozy currently offers SSO via Google Apps for Work and GitHub Organizations.

SAML 2.0

In order to facilitate user authentication through the web browser and improve identity management, Apozy offers assertion markup language (SAML)-based SSO as a standard feature to customers. SAML 2.0 enhances user-based security and streamlines signup and login from trusted portals to enhance user experience, access management, and auditability.

Apozy integrates with SAML 2.0 providers including OneLogin, Auth0, and Okta (as well as enhanced member administration and management on the Medium and Large plans via an integration with Rippling).

REST API Authentication (API Key)

Apozy’s REST API uses personal auth tokens or an API key for authentication. Authentication tokens are passed using the auth header and are used to authenticate a user account with the API.

API keys are a legacy means of authenticating. They are still supported in Apozy but are disabled for new accounts. We strongly recommend using authentication tokens.

Email Security

The Apozy service includes email notifications and reports. Sender policy framework (SPF) is a system to prevent email address spoofing and minimize inbound spam. We have SPF records set through our domain name service (DNS), and domain-based message authentication, reporting, and conformance (DMARC) set up for monitoring reports to prevent the possibility of phishing scams.

Audit Controls

We know user administration is central to security and management, and auditing user logs is often the first step in both an emergency response plan and policy compliance requirements. All Apozy customers get admin controls governing identity, access, and usage to keep your data safe, secure, and centrally managed.

Membership within Apozy is handled at the organization level. The system is designed so each user has a singular account that can be reused across multiple organizations (even those using SSO). Each Apozy user should have their own account and can choose their own personal preferences and notifications settings.

For any organization on a Apozy plan, the project administration portal is the hub for seeing and managing users and usage. The member list includes the username, email, status, added date, teams, and role for each user. The admin or owner can revoke access by project, team, or org and change user role. Additionally, the admin can request login and password history and revoke passwords and active sessions for any user via request to Apozy Support.

In the audit log, all of the actions by user and event within the Apozy UI (e.g., member.invite, project.create) are listed chronologically by time and IP address so you’ll always have a view into your organization’s most recent history.

Secure Application Development (Application Development Lifecycle)

Apozy practices continuous delivery, which means all code changes are committed, tested, shipped, and iterated on in a rapid sequence. A continuous delivery methodology, complemented by pull request, continuous integration (CI), and automated error tracking, significantly decreases the likelihood of a security issue and improves the response time to and the effective eradication of bugs and vulnerabilities.

Corporate Security

Malware Protection

At Apozy, we believe that good security practices start with our own team, so we go out of our way to protect against internal threats and local vulnerabilities. All company-provided workstations have full-disk encryption, screen lock, and other security features.

Risk Management

Apozy follows the risk management procedures outlined in NIST SP 800-30, which includes nine steps for risk assessment and seven steps for risk mitigation.

All Apozy product changes must go through code review, CI, and build pipeline to reach production servers. Only designated employees on Apozy’s operations team have secure shell (SSH) access to production servers.

We perform testing and risk management on all systems and applications on a regular and ongoing basis. New methods are developed, reviewed, and deployed to production via pull request and internal review. New risk management practices are documented and shared via staff presentations on lessons learned and best practices.

Apozy performs risk assessments throughout the product lifecycle in accordance with the standards set forth in HIPAA Security Rule, 45 CFR 164.308:

* Before the integration of new system technologies and before changes are made to Apozy physical safeguards
* While making changes to Apozy physical equipment and facilities that introduce new, untested configurations
* Periodically as part of technical and non-technical assessments of the security rule requirements as well as in response to environmental or operational changes affecting security

Security Training

All new employees receive onboarding and systems training, including environment and permissions setup, formal software development training (if pertinent), security policies review, company policies review, and corporate values and ethics training.

All engineers review security policies as part of onboarding and are encouraged to review and contribute to policies via internal documentation. Any change to policy affecting the product is communicated as a pull request, such that all engineers can review and contribute before internal publication. Major updates are communicated via email to all Apozy employees.

Disclosure Policy

Apozy follows the incident handling and response process recommended by SANS, which includes identifying, containing, eradicating, recovering from, communicating, and documenting security events. Apozy notifies customers of any data breaches as soon as possible via email and a phone call, followed by multiple periodic updates throughout each day addressing progress and impact. Apozy Enterprise plans include a dedicated customer success manager who holds responsibility for customer communication, as well as regular check-ins and escalations.

Any known incidents are reported via email, as well as on our Twitter feed.