xcPEP Trust Center

2. Security & Compliance

Robust Security Architecture

Our solution is built upon a foundation of industry-leading security practices, integrating comprehensive security measures across all layers of our architecture – from network perimeter to application logic. We continuously employ a multi-layered security approach, utilizing perimeter firewalls, Web Application Firewalls (WAF), Intrusion Detection/Prevention Systems (IDS/IPS), and advanced Anti-Virus solutions to protect against threats. We adhere to the OWASP Top 10 web application vulnerability checklist standards and implement robust prevention mechanisms against common attacks like SQL injections and various bot attacks. This includes strict limitations on failed login attempts, page views, and application sessions to prevent brute-force attacks and abuse.

 Data Privacy and Encryption

Your data privacy is paramount. We operate under a strict Data Privacy Policy outlines our commitment to protecting your information. We ensure all critical user information in the database is encrypted using strong algorithms like AES 256 with a secret key and IV. Passwords are securely hashed with a robust algorithm. All critical URLs and information in URL query strings are encrypted. Furthermore, critical information within our logs is either encrypted or removed to maintain privacy. We enforce a strict HTTPS policy, and all communication with third parties and sensitive services utilizes two-way peer-to-peer SSL encryption. Data is encrypted both in transit (using protocols like TLS 1.2 or higher) and at rest.

Identity and Access Management

We provide comprehensive Authentication, Access, and Identity Management solutions, including support for multi-factor authentication (MFA) to provide an additional layer of security for user accounts. Available MFA methods include [list specific methods, e.g., TOTP (Time-based One-Time Password), SMS verification, authenticator apps]. We offer granular control over network access, allowing for restriction by named IPs or IP ranges. Our solution enables the enforcement of custom password policies to align with your organization's security requirements. We provide robust Roles-Based Access Control (RBAC), allowing you to define and manage user permissions based on roles, attributes, or hierarchical structures within the application. User sessions are securely managed at the application level, with configurable active and inactive session timeouts to prevent unauthorized access.

Auditing and Monitoring

All access to customer data is meticulously logged and continuously monitored for traceability. These logs provide a comprehensive audit trail of user accounts and historical activities, which can be exported for your review.

Vulnerability Management & Incident Response

We conduct regular Vulnerability Assessment and Penetration Testing (VAPT) at a frequency of once per quarter. We are committed to notifying customers promptly of any breaches involving their data. Our Data Breach Notification Policy outlines the procedures and timelines for such notifications.

Secure Software Development Lifecycle (SDLC)

Our codebase is securely hosted in a premium version control system (e.g., GitHub Enterprise account), ensuring strict access controls and versioning. We integrate security throughout our Secure Software Development Lifecycle (SDLC), embedding security measures from the design phase through deployment, ensuring the development of secure software.

Employee Access Controls

We implement stringent employee access controls, ensuring that only authorized personnel have access to sensitive systems and customer data, based on the principle of least privilege. All employee access is logged and regularly reviewed.

Compliance and Certifications

We are ISO/IEC 27001:2013 Certified, demonstrating our adherence to global information security management standards