12d Synergy Security Statement

Table of Contents Show
Reading Time: 3 minutes

Overview

Keeping our customers’ data protected at all times is our highest priority. This security overview provides a high-level overview of the security practices put in place to achieve that objective. Have questions or feedback? Feel free to reach out to us at support@12dSynergy.com.

Cloud Infrastructure

Our cloud service is built on Microsoft Azure. They provide strong security measures to protect our infrastructure and are compliant with most certifications. You can read more about their practices here:

https://docs.microsoft.com/en-us/azure/security/fundamentals/overview

Network level security monitoring and protection

Our network security architecture consists of multiple security zones. We monitor and protect our network, to make sure no unauthorized access is performed using:

  • A firewall that monitors and controls incoming and outgoing network traffic
  • Just-in-time access to servers via ACLs and IP address filtering
  • Azure offerings for intrusion detection and protection

Data encryption

Encryption in transit: All data sent to or from our infrastructure is encrypted in transit via industry best-practices using Transport Layer Security (TLS). You can see our SSLLabs reports here:

https://www.ssllabs.com/ssltest/analyze.html?d=synergy.12dsynergycloud.com
https://www.ssllabs.com/ssltest/analyze.html?d=12dsynergy.com

Encryption at rest: All our user data is encrypted using industry proven encryption algorithms in the database and on disk.

Data retention and removal

We retain support tickets and relevant contact information while you are a customer. You may request removal of your data by contacting support@12dsynergy.com. Read more our Privacy Notice for more information.

Business continuity and disaster recovery

We back up all our critical assets and regularly attempt to restore the backup to guarantee a fast recovery in case of disaster. All our backups are encrypted.

Application security monitoring

  • We use a security monitoring solution to get visibility into our application security, identify attacks and respond quickly to a data breach.
  • We use technologies to monitor exceptions, logs and detect anomalies in our applications.
  • We collect and store logs to provide an audit trail of our applications activity.

Secure development

We develop the following security best practices and frameworks (OWASP Top 10, SANS Top 25). We use the following best practices to ensure the highest level of security in our software:

  • Developers participate in regular security training to learn about common vulnerabilities and threats
  • We review our code for security vulnerabilities
  • We regularly update our dependencies and make sure none of them has known vulnerabilities
  • We use Static Application Security Testing (SAST) to detect basic security vulnerabilities in our codebase

User protection

Role-based access control

Role-based access control (RBAC) allows our users to define roles and permissions in our cloud environment.

Compliance

12d Synergy ensures compliance with all legislation, regulations and code of practice relevant to its activities.

GDPR

We’re compliant to the General Data Protection Regulation (GDPR) and UK GDPR. The purpose of GDPR is to protect the private information of EU citizens and give them more control over their personal data. Contact us for more details on how we comply to GDPR.

Employee training

12d Synergy provides regular information security education and training to all our staff to ensure staff are aware of security best practice, and must read and sign relevant security policies when joining the company. This training is updated on an as needs basis and staff undergo this training annually.

Employee access

  • Our strict internal procedure prevents any employee or administrator from gaining access to user data. Limited exceptions can be made for customer support.
  • All customer support members who may need access to customer data are subject to thorough background checks.
  • All our employees sign a Confidentiality Agreement when joining the company to protect our customers’ sensitive information.

Vulnerability Disclosure

Anyone can report a vulnerability or security concern with a 12d Synergy product by contacting security@12dsynergy.com and including a proof of concept, a list of tools used (including versions), and the output of the tools. We take all disclosures very seriously, and once we receive a disclosure we rapidly verify each vulnerability before taking the necessary steps to fix it. Once verified, we periodically send status updates as problems are fixed.

To encrypt sensitive information that is sent to us, our PGP key can be found on keyservers with the fingerprint:

DAFB7D703DEA8524D9C06F673DE9B545EDF5469B

Relevant Policies

You can read more about our policies here: