Security & Compliance at Applozic
We know that you owe your customers the promise that their data will be handled safely and securely and with our integration there is exchange of user, messages, files and communication data that's collected.
At Applozic, we take data integrity and security very seriously. Due to the nature of the product and service we provide, it is important that we acknowledge our responsibilities both as data controller as well as a data processor. We store and process your data and that of your customers with care and help you be compliant so that you can continue to build trust while enhancing customer experiences.
We help you assure your customers chat, messaging and other transactional data are and will always be secure. The promise of security stems from the very system that handles all customer data and is an essential part of our product, processes, and team culture.
Our facilities, processes and systems are reliable, robust and third-party tested. We continuously look for opportunities to make improvements and give you a highly secure, scalable system to provide a great chat & messaging experience to your customers.
- Securing your customers’ payment and personal information: compliance GDPR.
- Ensuring Internal Data security of your data that rests with Applozic: adherence MFA standards.
- Network Security within Applozic: Network, application and operational level security policies that we follow.
The General Data Protection Regulation (GDPR) is a European privacy law which became enforceable on May 25, 2018. The GDPR replaces the EU Data Protection Directive, also known as Directive 95/46/EC, and is intended to harmonize data protection laws throughout the European Union (EU) by applying a single data protection law that is binding throughout each member state.
Our GDPR Commitment
The core of Applozic’s internal operations underpins protecting the personal data of our customers. We only collect and store information that is necessary to offer our service, and we do this with the consent of our customers. Adding to this, our approach towards privacy, security, and data protection align with the goals of GDPR.
Along with a highly secure and robust system architecture, we have a variety of security measures in place to prevent unauthorized access and processing of personal data. To know more about our technical and organizational security measures, check out our security page.
By setting up an internal compliance team (with functional heads) who worked with an external specialist from a audit firm, our requirements were assessed and the required changes were rolled out.
Physical and Network security
Applozic uses Amazon's AWS platform and infrastructure. Applozic employees do not have any physical access to our production environment.
Here are more details about the security setup of AWS.
Cloud security is the highest priority at AWS. As an AWS customer, we are benefitted from a data center and network architecture built to meet the requirements of the most security-sensitive organizations.
“Amazon has many years of experience in designing, constructing, and operating large-scale data centers. This experience has been applied to the AWS platform and infrastructure. AWS data centers are housed in nondescript facilities, with military grade perimeter control berms. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, state of the art intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication no fewer than three times to access data center floors. All visitors and contractors are required to present identification and are signed in. They are also continually escorted by authorized staff.”
- Distributed Denial Of Service (DDoS) Attacks
- Man In the Middle (MITM) Attacks
- Port Scanning
- Packet sniffing by other tenants
We at Applozic, use two-factor authentication to grant access for our administrative operations including both, infrastructure and Applozic service. Administrative privileges are restricted to very few employees. Additionally, both application level roles and AWS roles are used to ensure only required operations are allowed for specific users.
Any administrative access is automatically logged and mailed to our internal security team. Detailed information on when/why the operations are carried out are documented and notified to the security team before performing any changes in the production environment.
SSH keys are required to gain console access to our servers and each login is identified by a user. All critical operations are logged to a central log server and our servers can be accessed only from restricted and secure IPs.
Hosts are segmented and accesses are restricted based on functionality. That is, application requests are allowed only from AWS ELB and database servers can be accessed only from application servers.
Applozic’s application servers can be accessed only via HTTPS. We use industry standard encryption for data traversing to and from the application servers.
All user input is properly encoded when displayed to ensure XSS vulnerabilities are mitigated.
All POST requests are checked for CSRF token before processing the request.
We use prepared statements for database access to avoid SQL Injection attacks.
Encrypted Data Storage
We do not store sensitive card details on any Applozic network. The keys for various third party services (like payment gateway) are stored in our database in encrypted form.
Vulnerability Scanning & Patching
We periodically check and apply patches for third-party software/services. As and when vulnerabilities are discovered we apply the fixes. We do periodic vulnerability scanning using the services of an authorized QSA.Applozic performs the VAPT assessment on an annualized basis.
Data Storage & Redundancy
We use Amazon's RDS for our database. The automated backup feature is configured for RDS. We backup data for upto 30 days. We have configured Amazon RDS in Multi-AZ which provides enhanced availability and durability. Each AZ runs on its own physically distinct, independent infrastructure, and is engineered to be highly reliable. Know more.
We use both internal and multiple external monitoring services to monitor Applozic. Our monitoring system will alert the Operations & Security Team through emails and phone calls if there are any errors or abnormalities in the request pattern.
We are working continuously to make our system secure. If you find any security issue, please send it to firstname.lastname@example.org . We will make sure the issue is fixed and updated at the earliest.