Security Policy
Our Security Policy was last updated on October 15, 2024.
Cloud security is important for the protection of hosted information. Even small gaps in security coverage can put everything at risk, including data, customer information, uptime, and potentially a company’s reputation. A certain amount of confidence is needed when relying on third-party vendors to manage and handle your data. We want our customers to have a general understanding of what we at CloudAMQP are doing to protect the integrity of their data.
This living, continuously-updated document will give a brief introduction to the security policies at CloudAMQP. Because effective security is a team effort, our security policies are not limited to this document alone. We routinely audit and manage the security of our services and adopt best practices for our security policy.
Our internal development, operations, and processes have been constructed to provide maximum data security.
System security
Coding Standards and Development
A well-built environment starts with high coding standards that guard against attempted security breaches and are accompanied by code reviews and tests. We have strict development processes and we are following specified coding standards to ensure the best security practices.
Application Security
System components undergo tests (various black box and white box tests) and source code reviews to assess the security of our application interface, architecture, and service layers before we add our code into production. CloudAMQP always reviews the security of third-party applications before we are adding them to CloudAMQP services.
System Configuration
Server and system access is limited to a few authorized people at CloudAMQP and requires short-lived signed SSH keys and two-factor authentication. Furthermore, everyone at CloudAMQP is forced to enable two-step authentication on every cloud platform. Individual authentication credentials are never shared.
Patch Management
CloudAMQP always applies patches when advised by the manufacturer for our servers and associated devices. Critical patches are applied within 48 hours of release.
End-Point Security
All end-points (computers, laptops, mobile phones, etc.) use encrypted storage, secure passwords, and auto-locking mechanisms. In the case of mobile phones, only applications from trusted application stores such as the AppStore and the Google Play Store are allowed. All end-point devices are patched to the latest stable OS update and application updates. Malware and anti-virus applications are installed where applicable.
Physical Data Center Security
Our physical infrastructure is hosted and managed on a range of different data centers (AWS, Azure, GCE, Digital Ocean etc.). We rely on their flexible and secure cloud infrastructure to store data logically across multiple cloud regions and availability zones. The data centers ensure the utmost in data security and protection and that all data is stored in highly-secure locations. All data centers that run our solution are secured and monitored 24/7. Physical access to data center facilities is strictly limited to select cloud staff. The data centers and staff continually manage risk and undergo recurring assessments to ensure compliance with industry standards.
How specific data centers handle fire detection, power loss, climate disasters, temperature control, data center management, and other disasters can be found on the data centers’ websites.