Trust Center

Production access review

Our information security officer reviews and approves once a year who has access to the production console.

Incident records

We keep a record of every security incident, its investigation and the response we carried out under our incident procedure.

Vulnerability scanning

We scan the platform for vulnerabilities on a regular schedule.

Central vulnerability tracking

Every vulnerability we find is tracked centrally and fixed within the time our vulnerability policy sets.

Change notifications

Key people are notified whenever a change is deployed to production, so only authorized changes go live.

Approved access

Access to critical systems is only granted after approval by authorized staff, for an individual need or a predefined role.

Access removal on exit

When someone leaves, the access they no longer need is removed without delay.

Production database access

Only people who need it for their job can reach the production databases.

Multi factor authentication

Every staff member with access to a critical system signs in with multi factor authentication.

Privilege reviews

Senior management or the information security officer regularly checks that access to critical systems is limited to the people who need it.

Admin access reviews

Administrative access to critical systems is reviewed regularly in the same way.

Encryption at rest

All production databases that hold customer data are encrypted at rest.

Infrastructure inventory

We keep an up to date inventory of our infrastructure systems, with the details needed to know who is accountable for each.

Backups

User and system data is backed up regularly to meet our recovery time and recovery point objectives, and every backup is checked for integrity.

Backup restore tests

We test backups periodically to confirm they can be restored and the data is intact.

Control monitoring

Our systems generate information that we review to see whether internal controls are working.

No public database access

Production databases and SSH access to our infrastructure cannot be reached from the public internet.

Deny by default firewall

Every production host sits behind a firewall that blocks all traffic unless it is explicitly allowed.

Encryption in transit

Data in transit is encrypted with standard methods, including HTTPS over TLS.

Threat detection

Audit events are analyzed to detect unusual or suspicious activity.

Capacity monitoring

Critical systems are monitored continuously, with alerts on capacity, to keep performance up and protect against denial of service attacks.

Test data protection

Customer data used outside production gets the same protection as in production.

Central security logs

All critical systems produce audit events for security relevant actions, collected in one place.

Public privacy notice

Our website shows the current information about our services and a clear link to our privacy notice.

Change management

Changes to our operating environment follow a documented procedure.

Change approval

Changes to the operating environment need approval before they are carried out.

Role change alerts

When someone changes role, continuous monitoring tells the security team to adjust their access.

Malware protection

Laptops and other devices with access to critical servers or data run malware protection.

Device encryption

Those devices use full disk or container encryption.

Device checks

Before a device connects to our internal systems, its software versions and patches are checked.

Screen lock

Devices with access to critical servers or data lock automatically after 15 minutes of inactivity.

Encrypted critical devices

Every critical device is encrypted against unauthorized access.

Code of conduct

A written code of business conduct sets the standard for how we behave.

Organizational structure

Our structure defines who has which authority and responsibility.

Roles and responsibilities

Staff are told what their role and responsibilities are.

Qualified security staff

Security related positions are filled by people with the right skills.

Background screening

People are screened for security risks before they get access.

Policies at onboarding

New staff confirm that they have read the company policies that apply to them.

Security and privacy training

Staff get security and privacy training that fits their job.

Performance reviews

People in client facing, IT, engineering and security roles are evaluated periodically on their responsibilities.

Periodic policy confirmation

Staff confirm the applicable policies again at regular intervals.

Internal incident reporting

Our policies tell employees how to report failures, incidents and concerns about our services or systems.

Customer incident reporting

Customers know how to report failures, incidents and concerns to us.

Annual risk assessment

Once a year we carry out a formal risk assessment to find threats to our security commitments.

Risk scoring

Each risk gets a score for likelihood and impact on security, availability and confidentiality, and is linked to the measures that reduce it.

Fraud risk

The risk of fraud is part of our risk matrix.

Vendor risk assessment

Once a year we assess which vendors are critical to our security commitments.

Information security officer

Senior management has appointed an information security officer who runs the security and privacy program.

Continuous internal audit

Sprinto tracks the health of the security program and reports it to the information security officer and other stakeholders.

Program review

Senior management reviews and approves the security program, its policies and procedures at planned intervals and after significant changes.

Org chart review

Senior management reviews and approves the organization chart every year.

Risk report review

Senior management reviews and approves the risk assessment report every year.

Vendor risk report review

Senior management reviews and approves the vendor risk assessment report every year.

Subprocessor evaluation

We evaluate our subservice organizations periodically, so we can keep our commitments to customers.

Segregation of duties

Responsibilities and duties are split across people to reduce risk to the services we provide.

Contingency plan tests

We test our contingency plan regularly to check that we are ready to carry it out.

PCI DSS responsibilities

We keep a list of which PCI DSS requirements each service provider manages and which we manage ourselves.

Asset ownership

Every asset has an owner who is responsible for protecting it.

Legal and regulatory requirements

We keep a list of the legal, statutory and regulatory requirements that apply to our information security.

Onboarding training records

New staff complete security and privacy training during onboarding, and we keep the records.

Training records

We document, monitor and keep every person's training activities.

Inventory upkeep

The system inventory is updated whenever systems are installed, removed or updated.

Device inventory

We keep an inventory of all devices, with the details needed to know who is accountable for each.