Security Policy

Data protection and privacy is at the forefront of all Intalayer services and we take the trust you put in us very seriously. Intalayer is built on modern technology and hosted on Amazon Web Services (AWS), employing state-of-the-art security measures. This Security Policy aims to give you confidence that your trust is well placed in us.

Application Monitoring

• On an application level, we produce audit logs for all activity.
• All access to Intalayer applications is logged and audited.
• All actions taken on production consoles or in the Intalayer application are logged.
• Errors are automatically distributed via email to the development team to reduce bug time. We strive to provide an uninterrupted service, however if you continue to experience issues, please reach out at support@intalayer.com or visit https://intalayer.freshdesk.com/support/home.
• Key services are alarmed to provide early warning, allowing proactive intervention and preventing down-time.

Employee Access

• We follow the principle of least privilege in how we write software as well as the level of access employees are instructed to utilize in diagnosing and resolving problems in our software and in response to customer support requests.
• Access to production data resources is strictly controlled and only accessible by senior staff.
• Access to administrative interfaces additionally enforce administrator permissions where applicable.
• Employee computers have strong passwords, use 2-factor authentication where possible and are extensively trained on web security best practice.

Authentication

• All Intalayer services requires authentication with our servers where appropriate.
• All Intalayer 3rd party integrations follows best practice authentication and security policies as suggested by the 3rd party services.
• All Intalayer services, 3rd party or otherwise, implement multi-level authentication and security practices where possible.
• All Intalayer 3rd party integrations adhere to the industry standard OAuth 2.0 standard for authorizing secure access where available. Intalayer does not store passwords from 3rd party integrations and you can revoke OAuth tokens at any time.
• All logins to the Intalayer application that require passwords are salted and irreversibly hashed before storage.

Encryption

• Intalayer is served 100% over HTTPS and SSL certificates are 2048 bit RSA, signed with SHA256.
• All data is encrypted at rest using industry standard AES-256 bit encryption.

Data

• We employ unit and integration tests to ensure privacy controls work as expected. These tests are run every time our codebase is updated and even a single test failing will prevent new code being shipped to production.
• Our Privacy Policy outlines how we deal with data
• We employ multi-tenanted data backups and restoration procedures to mitigate data loss.

Infrastructure

• All of our services and data are hosted in AWS facilities in the USA and protected by AWS security, as described at http://aws.amazon.com/security/sharing-the-security-responsibility.
• AWS adheres to the following security, privacy-related audits and certifications: SOC 1/SSAE 16/ISAE 3402 (formerly SAS700, SOC2, SOC3, FISMA, DIACAP, FedRAMP, DOD CSM levels 1-5, PCI DSS Level 1, ISO 9001/ISO 27001, ITAR, FIPS 140-2 and MTCS Level 3.
• All of our servers sit within a virtual private cloud (VPC) behind a firewall with network access control lists (ACL’s), preventing unauthorized requests getting to our internal network.

Customer Responsibilities

• Compliance with the terms of your services agreement with Intalayer, including with respect to compliance with laws.
• Promptly notifying Intalayer if a user credential has been compromised or if you suspect possible suspicious activities that could negatively impact security of the Intalayer services or your account.
• You may not perform any security penetration tests or security assessment activities without the express advance written consent of Intalayer.

Code Reviews and Production Signoff

• All changes to source code destined for production systems are subject to pre-commit code review by a qualified engineering peer that includes security, performance, and potential-for-abuse analysis.
• Prior to updating production services, all contributors to the updated software version are required to approve that their changes are working as intended on staging servers.
• We follow a strict Test Driven Development policy, implementing production CI/CD pipelines to maximise robust and stable performance.
• Intalayer obsesses over security and implementing best practice. We follow OWASP secure coding practices. Every pull request is reviewed for possible attack vectors and vulnerabilities. Senior engineering staff also periodically perform secure coding reviews on the entire application covering the OWASP top 10 security flaws and other common attack vectors.

Credit Card Safety

• When you sign up for a paid account on Intalayer, your credit card information is handed off to Stripe, a company dedicated to storing your sensitive data on PCI-Compliant servers. Our servers do not store or even see your credit card information.