Security Controls

Controls currently in place across the Preservus platform.

Access Control and Authorization

Authorization enforced on every request

Every request for customer data is authorized against the requester's verified identity before any data is returned.

Authorization coverage verified automatically

Automated tests verify that every part of the service enforces an authorization decision, and block any release that does not.

Least-privilege access granting process used

Access is granted only for a legitimate operational purpose and only at the level the role requires.

Access revoking process enforced

Access privileges are removed promptly on role change and on departure.

Access reviews performed quarterly

Accounts, group memberships, and privileges are reviewed at least quarterly, and the review is recorded.

MFA required for privileged access

Multi-factor authentication is required for administrative access to production systems and critical services.

MFA available to all customer accounts

Authenticator-app multi-factor authentication is offered to every customer account.

Password management policy enforced

Password requirements are enforced by the authentication service, and passwords known to have appeared in public breaches are rejected.

Unique authentication enforced

Every account is individually identified. Shared or generic accounts are not used for access to production or customer data.

Session lifetimes bounded

Sessions expire on a fixed schedule and are built from short-lived credentials that rotate.

Standing credentials eliminated

Administrative and deployment access is issued as short-lived federated credentials. No long-lived access keys are held, and no credentials are stored in code or configuration.

Customer-directed sharing controls

Customers grant collaborators a defined level of access, scoped to the records they choose and enforced by the service.

Replay-resistant authentication used

Sign-in uses a challenge-response protocol, so an account password is never transmitted to the service.

Account lockout enforced

Repeated failed sign-in attempts lock an account against further attempts.

Data Management and Protection

Data encrypted at rest

All customer data is encrypted when stored, under encryption keys the organization manages and rotates.

Data encrypted in transit

All data is encrypted when transmitted over networks, on both external and internal connections.

Data labeled by sensitivity level

Each type of information the service holds is classified for confidentiality, integrity, and availability impact, and handled accordingly.

Data inventory maintained

An inventory of data assets and the flows between them is maintained and kept current with the system.

Data management and retention policy established

Data is retained only as long as needed to provide the service and is deleted on account closure.

Customer files not publicly accessible

Uploaded files are held in private storage with no public route, and are served only to an authenticated session.

Customer data excluded from development and testing

Development and testing run on synthetic data. Any exception requires written approval and the copy is destroyed when the work concludes.

Data residency in the United States

All customer data is stored and processed in United States regions.

Backup and Recovery

Automated backups enabled

Continuous automated backup is enabled for all customer data stores.

Point-in-time recovery enabled

Customer records can be restored to a prior point in time within a defined recovery window.

Uploaded documents recoverable after deletion

An overwritten or deleted document remains recoverable for a defined window before deletion completes.

Deletion protection enforced on data stores

Customer data stores are protected against destruction, including by an operator acting in error.

Environment rebuildable from source

All infrastructure is defined as code and can be rebuilt from version control.

Infrastructure Security

Storage not exposed publicly

Cloud storage holding customer data is not reachable from the public internet.

Data stores accept no anonymous access

Every request against a customer data store is authenticated and authorized against a narrowly scoped identity.

Component-level least privilege enforced

Each component of the service holds its own narrowly scoped permissions and can reach only the data its function requires.

Infrastructure deployed using an infrastructure-as-code tool

Infrastructure is declared in version-controlled code, giving consistent and reviewable deployment.

Infrastructure changes reviewed before apply

Infrastructure changes are proposed in version control, reviewed, and automatically scanned for insecure configuration, which blocks a change that fails.

Infrastructure changes logged

Administrative and configuration changes are recorded to support audit and investigation.

Unauthorized assets addressed

Any deployed resource not represented in version-controlled code is treated as unauthorized and removed.

Production deployment access restricted

Releases to production can be made only through the authorized pipeline by authorized personnel.

Non-production environments isolated

Development and testing environments are separated from production with their own credentials and their own data.

Physical security inherited from the cloud provider

The service runs entirely on cloud infrastructure. Physical and environmental controls are the provider's, evidenced by its SOC 2, ISO 27001, and FedRAMP authorizations.

Infrastructure drift detected automatically

Deployed resources are compared against a version-controlled inventory on an automated schedule, and anything not declared in code is reported for review.

TLS certificates managed automatically

Certificates are issued and renewed automatically, with no manual rotation step that can be missed.

Email authentication published

SPF, DKIM, and DMARC records are published for every domain that sends mail, with a dedicated return-path domain so signatures align to the sending domain.

Application Security

Software development lifecycle established

A documented development lifecycle governs how changes are proposed, reviewed, tested, and released.

Static application security testing performed

Automated security analysis runs on every change, and a failing check blocks the release.

Secret scanning enforced

Automated scanning blocks credentials and secrets from entering the source repository.

Infrastructure-as-code scanning enforced

Infrastructure definitions are scanned for insecure configuration on every change.

Released code cryptographically signed

Application code is signed before release, so only artifacts produced by the authorized pipeline can run.

Third-party components pinned and verified

Dependencies are pinned to exact, integrity-verified versions, as are the third-party steps in the build pipeline.

Software inventory maintained

An inventory of all third-party software in the service is maintained in version control and changes with it.

Input validation enforced

Requests are validated at the service boundary and again in the application before anything is processed.

Error responses disclose no internal detail

Errors return a structured message with no internal diagnostics, and requests to routes that do not exist reveal nothing about the service.

Vulnerability Management

Vulnerability management policy established

A documented policy governs how vulnerabilities are identified, triaged, dispositioned, and remediated.

Vulnerabilities scanned continuously

Automated scanning examines application code, infrastructure definitions, and dependencies on an ongoing basis.

Remediation timeframes defined and tracked

Severity sets the deadline: critical within 7 days, high within 30, medium within 90, low in the next scheduled cycle, timed from when the finding first appears.

Automated dependency patch management performed

Dependency updates are raised automatically and reviewed on a weekly cycle across the full dependency set.

Accepted risks recorded explicitly

Any finding not remediated carries a recorded disposition with its reason and residual risk. Silently suppressing a finding is prohibited.

Unsupported components replaced

The service runs on vendor-supported runtime and dependency versions. Components approaching end of life are replaced rather than carried.

Monitoring and Audit

Audit logs collected

Administrative action, authentication events, and access to customer records are recorded across the service.

Audit log integrity protected

Audit records carry integrity validation and are protected against deletion, including by privileged personnel.

Log retention schedule enforced

Retention is set so that any record a review or investigation needs remains available, with the record of administrative action retained indefinitely.

Automated alerting configured

Error, failure, and abuse conditions raise automated alarms to a monitored channel.

Log reviews performed quarterly

Logs are reviewed on alert, during incident handling, and at least quarterly, and each review records what it covered.

Abuse rate limiting enforced

Request rate limits are enforced on the service to constrain automated abuse.

Breach notification commitment established

On a confirmed incident affecting customer information, affected customers are notified and applicable breach-notification obligations are met.

Organizational Security

Information security policy established

A version-controlled information security policy is approved and reviewed at least annually and on material change.

Acceptable use policy established

Acceptable use of systems, credentials, and customer data is defined and applies to everyone with access.

Policy exceptions documented and time-bound

Every exception records the clause, the business reason, the residual risk, any compensating control, and an expiry date. Undocumented exceptions are prohibited.

Endpoint security requirements established

Devices used to reach customer data require disk encryption, automatic screen lock, a host firewall, and a currently patched operating system and browser.

Asset inventory maintained

The inventory of systems and software is held as version-controlled code, so it changes with the system rather than drifting from it.

Vendor inventory maintained

An inventory of subprocessors is maintained, recording the service provided, the data exchanged, and the terms governing it.

Vendor security reviewed before adoption

Providers are selected with regard to their security posture, including SOC 2 or ISO 27001 attestation where applicable, and re-reviewed on material change.

Security commitments externally communicated

Security commitments are published in the Terms of Service, the Privacy Policy, and the externally shareable security policy.