Security Controls
Controls currently in place across the Preservus platform.
No controls match that search.
Access Control and Authorization
Authorization enforced on every request
Every request for customer data is authorized against the requester's verified identity before any data is returned.
Authorization coverage verified automatically
Automated tests verify that every part of the service enforces an authorization decision, and block any release that does not.
Least-privilege access granting process used
Access is granted only for a legitimate operational purpose and only at the level the role requires.
Access revoking process enforced
Access privileges are removed promptly on role change and on departure.
Access reviews performed quarterly
Accounts, group memberships, and privileges are reviewed at least quarterly, and the review is recorded.
MFA required for privileged access
Multi-factor authentication is required for administrative access to production systems and critical services.
MFA available to all customer accounts
Authenticator-app multi-factor authentication is offered to every customer account.
Password management policy enforced
Password requirements are enforced by the authentication service, and passwords known to have appeared in public breaches are rejected.
Unique authentication enforced
Every account is individually identified. Shared or generic accounts are not used for access to production or customer data.
Session lifetimes bounded
Sessions expire on a fixed schedule and are built from short-lived credentials that rotate.
Standing credentials eliminated
Administrative and deployment access is issued as short-lived federated credentials. No long-lived access keys are held, and no credentials are stored in code or configuration.
Customer-directed sharing controls
Customers grant collaborators a defined level of access, scoped to the records they choose and enforced by the service.
Replay-resistant authentication used
Sign-in uses a challenge-response protocol, so an account password is never transmitted to the service.
Account lockout enforced
Repeated failed sign-in attempts lock an account against further attempts.
Data Management and Protection
Data encrypted at rest
All customer data is encrypted when stored, under encryption keys the organization manages and rotates.
Data encrypted in transit
All data is encrypted when transmitted over networks, on both external and internal connections.
Data labeled by sensitivity level
Each type of information the service holds is classified for confidentiality, integrity, and availability impact, and handled accordingly.
Data inventory maintained
An inventory of data assets and the flows between them is maintained and kept current with the system.
Data management and retention policy established
Data is retained only as long as needed to provide the service and is deleted on account closure.
Customer files not publicly accessible
Uploaded files are held in private storage with no public route, and are served only to an authenticated session.
Customer data excluded from development and testing
Development and testing run on synthetic data. Any exception requires written approval and the copy is destroyed when the work concludes.
Data residency in the United States
All customer data is stored and processed in United States regions.
Backup and Recovery
Automated backups enabled
Continuous automated backup is enabled for all customer data stores.
Point-in-time recovery enabled
Customer records can be restored to a prior point in time within a defined recovery window.
Uploaded documents recoverable after deletion
An overwritten or deleted document remains recoverable for a defined window before deletion completes.
Deletion protection enforced on data stores
Customer data stores are protected against destruction, including by an operator acting in error.
Environment rebuildable from source
All infrastructure is defined as code and can be rebuilt from version control.
Infrastructure Security
Storage not exposed publicly
Cloud storage holding customer data is not reachable from the public internet.
Data stores accept no anonymous access
Every request against a customer data store is authenticated and authorized against a narrowly scoped identity.
Component-level least privilege enforced
Each component of the service holds its own narrowly scoped permissions and can reach only the data its function requires.
Infrastructure deployed using an infrastructure-as-code tool
Infrastructure is declared in version-controlled code, giving consistent and reviewable deployment.
Infrastructure changes reviewed before apply
Infrastructure changes are proposed in version control, reviewed, and automatically scanned for insecure configuration, which blocks a change that fails.
Infrastructure changes logged
Administrative and configuration changes are recorded to support audit and investigation.
Unauthorized assets addressed
Any deployed resource not represented in version-controlled code is treated as unauthorized and removed.
Production deployment access restricted
Releases to production can be made only through the authorized pipeline by authorized personnel.
Non-production environments isolated
Development and testing environments are separated from production with their own credentials and their own data.
Physical security inherited from the cloud provider
The service runs entirely on cloud infrastructure. Physical and environmental controls are the provider's, evidenced by its SOC 2, ISO 27001, and FedRAMP authorizations.
Infrastructure drift detected automatically
Deployed resources are compared against a version-controlled inventory on an automated schedule, and anything not declared in code is reported for review.
TLS certificates managed automatically
Certificates are issued and renewed automatically, with no manual rotation step that can be missed.
Email authentication published
SPF, DKIM, and DMARC records are published for every domain that sends mail, with a dedicated return-path domain so signatures align to the sending domain.
Application Security
Software development lifecycle established
A documented development lifecycle governs how changes are proposed, reviewed, tested, and released.
Static application security testing performed
Automated security analysis runs on every change, and a failing check blocks the release.
Secret scanning enforced
Automated scanning blocks credentials and secrets from entering the source repository.
Infrastructure-as-code scanning enforced
Infrastructure definitions are scanned for insecure configuration on every change.
Released code cryptographically signed
Application code is signed before release, so only artifacts produced by the authorized pipeline can run.
Third-party components pinned and verified
Dependencies are pinned to exact, integrity-verified versions, as are the third-party steps in the build pipeline.
Software inventory maintained
An inventory of all third-party software in the service is maintained in version control and changes with it.
Input validation enforced
Requests are validated at the service boundary and again in the application before anything is processed.
Error responses disclose no internal detail
Errors return a structured message with no internal diagnostics, and requests to routes that do not exist reveal nothing about the service.
Vulnerability Management
Vulnerability management policy established
A documented policy governs how vulnerabilities are identified, triaged, dispositioned, and remediated.
Vulnerabilities scanned continuously
Automated scanning examines application code, infrastructure definitions, and dependencies on an ongoing basis.
Remediation timeframes defined and tracked
Severity sets the deadline: critical within 7 days, high within 30, medium within 90, low in the next scheduled cycle, timed from when the finding first appears.
Automated dependency patch management performed
Dependency updates are raised automatically and reviewed on a weekly cycle across the full dependency set.
Accepted risks recorded explicitly
Any finding not remediated carries a recorded disposition with its reason and residual risk. Silently suppressing a finding is prohibited.
Unsupported components replaced
The service runs on vendor-supported runtime and dependency versions. Components approaching end of life are replaced rather than carried.
Monitoring and Audit
Audit logs collected
Administrative action, authentication events, and access to customer records are recorded across the service.
Audit log integrity protected
Audit records carry integrity validation and are protected against deletion, including by privileged personnel.
Log retention schedule enforced
Retention is set so that any record a review or investigation needs remains available, with the record of administrative action retained indefinitely.
Automated alerting configured
Error, failure, and abuse conditions raise automated alarms to a monitored channel.
Log reviews performed quarterly
Logs are reviewed on alert, during incident handling, and at least quarterly, and each review records what it covered.
Abuse rate limiting enforced
Request rate limits are enforced on the service to constrain automated abuse.
Breach notification commitment established
On a confirmed incident affecting customer information, affected customers are notified and applicable breach-notification obligations are met.
Organizational Security
Information security policy established
A version-controlled information security policy is approved and reviewed at least annually and on material change.
Acceptable use policy established
Acceptable use of systems, credentials, and customer data is defined and applies to everyone with access.
Policy exceptions documented and time-bound
Every exception records the clause, the business reason, the residual risk, any compensating control, and an expiry date. Undocumented exceptions are prohibited.
Endpoint security requirements established
Devices used to reach customer data require disk encryption, automatic screen lock, a host firewall, and a currently patched operating system and browser.
Asset inventory maintained
The inventory of systems and software is held as version-controlled code, so it changes with the system rather than drifting from it.
Vendor inventory maintained
An inventory of subprocessors is maintained, recording the service provided, the data exchanged, and the terms governing it.
Vendor security reviewed before adoption
Providers are selected with regard to their security posture, including SOC 2 or ISO 27001 attestation where applicable, and re-reviewed on material change.
Security commitments externally communicated
Security commitments are published in the Terms of Service, the Privacy Policy, and the externally shareable security policy.