Public Information Security Statement

Information Security is at the heart of everything we do at BitSight.

So we’d like to explain how we store, process and secure our services. We have partnered with some of the best service providers in the world to ensure that we keep our customer’s information confidential, available and unaltered.

Last updated May 15, 2020

How to report a potential security issue?

If you believe you have found a security issue that pertains to BitSight Technologies, we ask that you report it to us confidentially by emailing bug@bitsight.com

  • Provide as much information on reproducing the issue as possible.
  • The BitSight security team will confirm receipt of your security concern in a timely manner.
  • Please provide reasonable time for the BitSight team to evaluate your report.
  • BitSight follows responsible disclosure and will credit researchers when a security issue has been identified and mitigated.

 

Where is customer data hosted?

BitSight is a SaaS platform that is 100% cloud-based in Amazon Web Services. We do not operate our own physical servers, routers, load balancers, or DNS servers. All of our servers are within our own virtual private cloud (VPC) with network access control lists (ACLs) that prevent unauthorized requests from reaching our internal network. Role-based access control (RBAC) is used to ensure only employees that need access to customer data have access.

 

Hosting Facilities

BitSight products run on world­ class infrastructure hosted at Amazon data centers running on Amazon Web Service (AWS) technology. Amazon data centers provide physical security 24/7, state­ of­ the­ art fire suppression, redundant utilities and biometric devices to ensure that our customers’ data is safe and secure. Amazon continually reviews and refines their procedures to comply with the latest security standards.

global-security

SOC 2 Type 2  

BitSight has a report on Controls at a Service Organization Relevant to Security available for review. To request the report, please contact soc2@bitsight.com

This report is intended to meet the needs of a broad range of users that need detailed information and assurance about the controls at a service organization relevant to security of the systems the service organization uses to process users’ data and the confidentiality and privacy of the information processed by these systems. These reports can play an important role in: 

  • Oversight of the organization
  • Vendor management programs
  • Internal corporate governance and risk management processes
  • Regulatory oversight

There are two types of reports: A type 2 report on management’s description of a service organization’s system and the suitability of the design and operating effectiveness of controls; and a type 1 report on management’s description of a service organization’s system and the suitability of the design of controls. Use of this report is restricted. soc-aicpa

  

 

GDPR and CCPA

BitSight is headquartered in the U.S. and all personal data is processed in the United States. For those customers with European users who would like to enter into a data protection agreement with us (including the standard contractual clauses), please send an email to privacy@bitsight.com.

BitSight continues to comply with the EU/Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information from European Union member countries/Switzerland. Please click here for more information on our Privacy Shield certification.

BitSight is CCPA compliant.

Please see our privacy policy for more information on how we process personal data.

 

Network Security

We protect communications between you and our systems. We take multiple steps to prevent eavesdropping between you and our systems, as well as within our infrastructure. For example, all network traffic runs over HTTPS (TLS), internal assets are isolated using strict filtering policies allowing only communication that is required and by default all access is denied and only explicitly allowed.

 

Security Operations 

If we see something, we’ll react and remedy the issue. We’re not resting on our laurels. We’re looking for breaches and system interruptions all the time. We’ve invested in ensuring we can detect and respond to security events and incidents that impact our infrastructure. Security Operations at BitSight is responsible for ensuring that:

  • We respond to all Infosec and US­-CERT alerts in an expedient fashion.
  • Incidents are responded to and communicated to all appropriate parties.
  • Corrective actions are executed.
  • Root cause analysis is performed.
  • Lessons learned are fed back to the appropriate internal teams.

 

System Security

We’re always updating our systems to protect your data. Our virtual systems are replaced on a regular basis with new, patched systems. System configuration and consistency is maintained using a combination of configuration management, up-to-date images and continuous deployment. Through continuous deployment, existing systems are decommissioned and replaced by up-to-date images at regular intervals. 

 

Restricted Access

Only people who need access, get access. Production system access is limited to key members of the BitSight Operations team and passwords are expressly forbidden. At a minimum, authentication requires two factors including asymmetric RSA public/private keys and a certificate based multifactored VPN connection. 

 

Third Party Assessments 

Don’t just take our word that our systems are secure. Even though BitSight services and processes are designed with security in mind, regular vulnerability tests are run to identify and remediate potential weaknesses. Periodic penetration and web application security assessments are conducted under the guise of expert third party vendors to ensure our applications and services are continually scrutinized for potential risk. In addition these tests can include static code analysis, white box and black box testing for vulnerabilities. 

 

Logging

We’re watching to find misuse or occasional problems. Logging is used extensively for application troubleshooting and investigating issues. Logs are streamed in real­time and over secure channels to a centralized logging service. This also allows our operations and development teams to view logs without the need to access to the production systems. We collect everything from application logs to AWS CloudTrail logs which form a complete audit trail of user and employee activity. 

 

Application Level Security 

We prevent single points of failure. Even if one system goes down or is breached, the rest of our services stay up and secure. All services are logically segmented following best practices, such as running applications services on dedicated instances. All login pages are secured via TLS over external and internal networks, and only certificates signed by well­ known Certificate Authorities (CAs) are allowed. All business-related communications, such as email and CRM, are encrypted while in transit as well as at­ rest. BitSight customer application passwords are hashed and salted at rest and even our own staff can’t retrieve them — if lost the password must be reset.

 

Encryption

The BitSight Security Ratings utilizes TLS encryption for all data in transit. Data at rest is encrypted using Amazon RDS encrypted DB instances that use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances.

 

Data Protection, Continuity and Retention

We backup and test our systems, just in case. Production data is mirrored to remote systems and automatically backed up on a regular basis. Production databases are replicated to avoid single points of failure. Recovery procedures are tested regularly by restoring from backup and simulating recovery of a production database. Backup retention varies by function and business impact. All production applications are deployed in multiple availability zones and leverage AWS Multi­-AZ technology, which can sustain the loss of an entire data center in a region.

 

Internal IT Security

We protect our own systems to protect your data. BitSight offices are protected behind network firewalls by well-known security vendors and secured by keycard access. Our employee laptops are imaged and managed using leading MDM software. Collaborative tools like email, document shares and calendars require two ­factor authentication to mitigate phishing attacks. Critical infrastructure passwords are locked in a virtual vault using AES­256 encryption and can only be accessed by a handful of individuals in the organization.

 

Training and Awareness

BitSight requires all employees and contractors to sign a confidentiality agreement prior to commencement of employment or the provision of services. Security awareness training is delivered to all employees and contractors and we continually publicize security alerts through our internal communication channels.

 

Questions?

If you have any questions about our security, feel free to reach out to our security team at psirt@bitsight.com.

 

 

FAQs

 

What types of personal data are required to use the service?

 

We require very limited personal data to use most of our products and services (typically just a name and email address). Please refer to our Privacy Policy for details.

 

How is data encrypted at rest?

 

At rest, all data lives within our Amazon Web Services (AWS) infrastructure located in US data centers. Resting data is encrypted using AWS provided technologies, which use a symmetric AES-GCM encryption algorithm with 256 bit encryption keys. Encryption keys are stored separately from encrypted data using AWS’ Key Management System (KMS).

 

How is data encrypted in transit?

 

TLS

 

Does BitSight have any security/privacy certifications?

 

Yes! BitSight is SOC II Type 2 certified and Privacy Shield Certified.

 

Does BitSight have an ISO 27001 certification?

 

BitSight does not, but Amazon AWS, our hosting provider does. Please see full details about AWS compliance here https://aws.amazon.com/compliance/

 

Does BitSight conduct due diligence around the data privacy and security practices of potential vendors, data processors and/or sub-processors?

 

Yes. Every new vendor must be vetted by the Legal, Security and Business Systems teams. This process includes completion of a detailed questionnaire, analysis of whether the vendor will have access to personal data, and submission of their penetration tests and security certifications.

 

Is BitSight HIPAA compliant?

 

No, the BitSight Security Ratings platform does not store or transmit protected health information (PHI).

 

Experience the BitSight Security Ratings Platform

Learn how you can simplify your risk management and take charge of your cybersecurity with these intuitive and powerful solutions.

Get Your Rating