Encryption at Rest
‍
All user information is encrypted at rest.
All Personally Identifiable Information (PII) is encrypted at rest.

Encryption Method

The System uses the industry standard AES-256 algorithm to encrypt all underlying storage for database instances, automated backups, and read replicas.

User Data Protection

The System allows for removal of user information upon request.

The System uses a data classification policy to determine how different types of data are handled. All user data is classified at the highest level of restriction.

There is a data protection policy and a defined process for responsible disclosure.

Backup & Replication

‍
The System performs daily backups of all database information and stores these encrypted backups across multiple redundant regions.
‍
The System further provides active redundancy, with live database replication across multiple regions.

Database Monitoring
‍
The System is configured to automatically and continuously monitor database CPU utilization, database read I/O, and database free storage space. Each monitoring category includes real-time alerting and visualization along with historical data and metrics.
‍
The System utilizes a data retention policy to determine when data should be retained and how it should be disposed of, when appropriate.

Password Rules


The System enforces password requirements that meet or exceed NIST Password Guidelines.

Passwords must be at least 16 characters long, or at least 8 characters long including a letter and a number.
‍
Passwords cannot exceed 512 characters in length.

Password Handling
‍
The System does not store passwords in plain text. Passwords are stored as hashes and are encrypted at rest.
‍
Passwords are not written to system logs.

The System uses the Bcrypt hashing function to generate password hashes, with a unique salt for each password.

The System limits the rate of password attempts at multiple levels, including per IP address, per user, and at the system-wide level.

Password Resets
‍
The System provides secure, single-use, time-expiring password reset credentials when requested by a user.

Token Signing
‍
The System uses JWT access tokens signed with the RSA 256 algorithm, an asymmetric public key algorithm.
‍
Token signing for the System exceeds the latest Commercial National Security Algorithm (CNSA) specifications for commercial cryptography, approved by the NSA to protect National Security Systems (NSS) up to the TOP SECRET level.

Private Key Security

The System encrypts all private signing keys at rest, such that theft of the database would not expose private signing key information.

Private signing keys are further encrypted using column-level encryption. This means that an active database connection also does not expose private signing key information.

Token Refresh

The System uses refresh tokens in conjunction with access tokens. Refresh tokens allow for shorter-lived access tokens, which improves security.

JWT Access Token Storage
‍
When logged into this application via a web browser, a user's JWT access token is stored as a cookie.
‍
This cookie is only sent with encrypted requests (HTTPS) to this application's originating website.

Refresh Token Storage

When logged into this application via a web browser, a user's refresh token is stored as a cookie.

This cookie is only sent with encrypted requests (HTTPS) to this application's originating website.

SOC 2
‍
This application uses Userfront for authentication and access control. Userfront is SOC 2 certified and was last audited by Ernst & Young on December 31, 2023.
‍
SOC 2 controls are further continuously monitored by Drata, with daily reporting on the status of all controls.