At TrustMAPP, the security and privacy of our customers’ data are top priorities. Robust security practices are implemented to ensure a secure and trustworthy platform. Below are the key measures employed to protect your data.
Data Security
Data stored in the Google Cloud Platform (GCP) environment is secured with strong AES-256 field-level encryption.
Data transferred between the TrustMAPP application and storage is encrypted using TLS 1.2, while communications between users and the application are secured with the highest browser-supported version of TLS.
Multi-tenancy
Role-Based Access Control (RBAC) and unique encryption keys ensure logical segregation of customer data, maintaining the confidentiality of each tenant’s information.
Compliance & Security Assessments
Regular assessments for compliance with established security standards and frameworks are conducted, employing a layered security approach throughout the Software Development Life Cycle (SDLC) and security operations.
Annual web application penetration tests are performed, with retesting to address any identified vulnerabilities.
Data Backup & Recovery
Application code is backed up on a regular schedule to a separate environment.
Customer data is continuously backed up using cloud services, ensuring availability and integrity.
Access Control
Access to the application and storage by TrustMAPP development teams is controlled through unique administrator accounts requiring multi-factor authentication (MFA) and machine identity certificates. Customers manage MFA through their Company Administrators.
System access is restricted based on roles and responsibilities, ensuring employees have only the necessary permissions. Application-level access is managed by each customer’s Company Administrator.
Logging & Monitoring
All access attempts and changes within TrustMAPP are logged and regularly reviewed by administrators. Application logging tracks modifications to tenant settings, users, and assessments.
Vulnerability Scanning
Ongoing vulnerability scanning is conducted to identify and address potential security issues proactively.
Cybersecurity Training
Cybersecurity awareness and privacy training is provided for all employees, fostering a secure operating environment.
Cloud Hosting
By default, TrustMAPP’s cloud services are hosted in the United States. However, hosting can be accommodated in other countries and locations, including on-premise solutions, when required contractually or by regulatory mandates.