Security and trust

We take the responsibility to protect your data seriously. This section describes the principles we work to, and how we prove our security and compliance practices to you and our auditors.

Governance

Policies and controls come first. They follow the principles below, and those principles are the standard our compliance is audited against.

1. Simplicity. In the software, we cut complexity that isn’t needed so the systems are easy to operate and audit. In the product, we collect only the information a job needs.
2. Granular, least privilege access. Data access goes only to someone with a real business need, in the narrowest way that works, and only for as long as they need it. The same rule applies to each system component.
3. Defense in depth. We use several layers of controls, and we monitor those controls. Components in a distributed system fail, so the system as a whole has to keep working when one of them fails or misbehaves.
4. Continuous improvement. We measure, evaluate and improve our security policies and controls as the business and the threats change. Each review looks for controls that work better, and for a clearer view of the protection we already have.

We maintain SOC 2 Type II attestation to demonstrate the successful application of our security controls on an ongoing basis.

Data protection

Data in transit, and data we store, is protected by strong encryption.

• Data at rest is on encrypted VM volumes and encrypted block storage, managed by AWS and GCP.
• We require TLS 1.2 or higher with strong cipher suites, and we enforce HSTS, so connections can’t be downgraded.
• Encryption keys and application secrets sit in the highest tier of our data classification, with strictly limited access. We use AWS Secrets Manager and Parameter Store so this material is touched as little as possible by hand.

Product security

To maintain confidence in our deployed software, we use a combination of:

• Regular penetration tests, covering the whole application. The latest test is always available in the Trust Center.
• Static analysis during development, by every developer, and again on each pull request.
• Vulnerability and dependency scanning, continuously on deployed code and during development, so the software stays free of known vulnerabilities and picks up released patches.
• Browser policy mechanisms (content security policy, feature policies and cross-domain policies), so a vulnerability in our code exposes as little as possible.

Internal security

Corporate and development environments are managed and monitored.

• Corporate hardware is centrally managed and tracked with Vanta’s MDM software, which checks disk encryption, screen lock, software updates and malware protection.
• Remote access to internal resources uses Tailscale.
• Employees and contractors take regular security awareness training.
• Google Workspace is our SSO provider, and every account requires 2FA.
• No-one has production access during their regular day-to-day work. Production work needs a separate sign-in, and the credentials last only for that task.
• Production data, including customer data, is not stored or processed on our corporate systems.

Data privacy

Our activities, policies and data management comply with the NZ Privacy Act. We collect only what On-Call Optimizer needs to function, and we treat that responsibility seriously.

• Every employee signs our security, privacy and confidentiality policies.
• Customer data is deleted when you ask, and shortly after a customer ends their service.

More details

The pages below go into each of these.