So we’d like to explain how we store, process and secure our services. We have partnered with some of the best service providers in the world to ensure that we keep our customer’s information confidential, available and unaltered.
Last updated May 15, 2020
If you believe you have found a security issue that pertains to BitSight Technologies, we ask that you report it to us confidentially by emailing email@example.com.
BitSight is a SaaS platform that is 100% cloud-based in Amazon Web Services. We do not operate our own physical servers, routers, load balancers, or DNS servers. All of our servers are within our own virtual private cloud (VPC) with network access control lists (ACLs) that prevent unauthorized requests from reaching our internal network. Role-based access control (RBAC) is used to ensure only employees that need access to customer data have access.
BitSight products run on world class infrastructure hosted at Amazon data centers running on Amazon Web Service (AWS) technology. Amazon data centers provide physical security 24/7, state of the art fire suppression, redundant utilities and biometric devices to ensure that our customers’ data is safe and secure. Amazon continually reviews and refines their procedures to comply with the latest security standards.
BitSight has a report on Controls at a Service Organization Relevant to Security available for review. To request the report, please contact firstname.lastname@example.org.
This report is intended to meet the needs of a broad range of users that need detailed information and assurance about the controls at a service organization relevant to security of the systems the service organization uses to process users’ data and the confidentiality and privacy of the information processed by these systems. These reports can play an important role in:
There are two types of reports: A type 2 report on management’s description of a service organization’s system and the suitability of the design and operating effectiveness of controls; and a type 1 report on management’s description of a service organization’s system and the suitability of the design of controls. Use of this report is restricted.
BitSight is headquartered in the U.S. and all personal data is processed in the United States. For those customers with European users who would like to enter into a data protection agreement with us (including the standard contractual clauses), please send an email to email@example.com.
BitSight continues to comply with the EU/Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information from European Union member countries/Switzerland. Please click here for more information on our Privacy Shield certification.
BitSight is CCPA compliant.
We protect communications between you and our systems. We take multiple steps to prevent eavesdropping between you and our systems, as well as within our infrastructure. For example, all network traffic runs over HTTPS (TLS), internal assets are isolated using strict filtering policies allowing only communication that is required and by default all access is denied and only explicitly allowed.
If we see something, we’ll react and remedy the issue. We’re not resting on our laurels. We’re looking for breaches and system interruptions all the time. We’ve invested in ensuring we can detect and respond to security events and incidents that impact our infrastructure. Security Operations at BitSight is responsible for ensuring that:
We’re always updating our systems to protect your data. Our virtual systems are replaced on a regular basis with new, patched systems. System configuration and consistency is maintained using a combination of configuration management, up-to-date images and continuous deployment. Through continuous deployment, existing systems are decommissioned and replaced by up-to-date images at regular intervals.
Only people who need access, get access. Production system access is limited to key members of the BitSight Operations team and passwords are expressly forbidden. At a minimum, authentication requires two factors including asymmetric RSA public/private keys and a certificate based multifactored VPN connection.
Don’t just take our word that our systems are secure. Even though BitSight services and processes are designed with security in mind, regular vulnerability tests are run to identify and remediate potential weaknesses. Periodic penetration and web application security assessments are conducted under the guise of expert third party vendors to ensure our applications and services are continually scrutinized for potential risk. In addition these tests can include static code analysis, white box and black box testing for vulnerabilities.
We’re watching to find misuse or occasional problems. Logging is used extensively for application troubleshooting and investigating issues. Logs are streamed in realtime and over secure channels to a centralized logging service. This also allows our operations and development teams to view logs without the need to access to the production systems. We collect everything from application logs to AWS CloudTrail logs which form a complete audit trail of user and employee activity.
We prevent single points of failure. Even if one system goes down or is breached, the rest of our services stay up and secure. All services are logically segmented following best practices, such as running applications services on dedicated instances. All login pages are secured via TLS over external and internal networks, and only certificates signed by well known Certificate Authorities (CAs) are allowed. All business-related communications, such as email and CRM, are encrypted while in transit as well as at rest. BitSight customer application passwords are hashed and salted at rest and even our own staff can’t retrieve them — if lost the password must be reset.
The BitSight Security Ratings utilizes TLS encryption for all data in transit. Data at rest is encrypted using Amazon RDS encrypted DB instances that use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances.
We backup and test our systems, just in case. Production data is mirrored to remote systems and automatically backed up on a regular basis. Production databases are replicated to avoid single points of failure. Recovery procedures are tested regularly by restoring from backup and simulating recovery of a production database. Backup retention varies by function and business impact. All production applications are deployed in multiple availability zones and leverage AWS Multi-AZ technology, which can sustain the loss of an entire data center in a region.
We protect our own systems to protect your data. BitSight offices are protected behind network firewalls by well-known security vendors and secured by keycard access. Our employee laptops are imaged and managed using leading MDM software. Collaborative tools like email, document shares and calendars require two factor authentication to mitigate phishing attacks. Critical infrastructure passwords are locked in a virtual vault using AES256 encryption and can only be accessed by a handful of individuals in the organization.
BitSight requires all employees and contractors to sign a confidentiality agreement prior to commencement of employment or the provision of services. Security awareness training is delivered to all employees and contractors and we continually publicize security alerts through our internal communication channels.
If you have any questions about our security, feel free to reach out to our security team at firstname.lastname@example.org.
At rest, all data lives within our Amazon Web Services (AWS) infrastructure located in US data centers. Resting data is encrypted using AWS provided technologies, which use a symmetric AES-GCM encryption algorithm with 256 bit encryption keys. Encryption keys are stored separately from encrypted data using AWS’ Key Management System (KMS).
Yes! BitSight is SOC II Type 2 certified and Privacy Shield Certified.
BitSight does not, but Amazon AWS, our hosting provider does. Please see full details about AWS compliance here https://aws.amazon.com/compliance/
Yes. Every new vendor must be vetted by the Legal, Security and Business Systems teams. This process includes completion of a detailed questionnaire, analysis of whether the vendor will have access to personal data, and submission of their penetration tests and security certifications.
No, the BitSight Security Ratings platform does not store or transmit protected health information (PHI).