Security Information

This website is accessed over the public Internet, and your connection to it is fully encrypted and secure. We have implemented a wide range of measures to ensure the security of the data entrusted to us by customers.

Infrastructure

• Redundant and fault-tolerant servers
• Multiple data centers
• Battery and diesel generator backup power
• Multiple network connections
• Fire suppression systems

Technology

• Secure data encryption
• Intrusion prevention systems
• Firewalls
• Data backups
• Server hardening
• Routine security updates
• Vulnerability and antivirus scanning
• Penetration testing
• Email encryption

Secure Facilities

• Biometric locks
• On-site security
• Video monitoring

Security-Aware Company Culture

• Security and privacy training
• Individual acknowledgment of policies
• Frequent password changes

Business Processes

• Code reviews
• Thorough testing and release planning
• “Need-to-know” access policies
• Secure data disposal practices

Internal Controls
We have controls in place to ensure that sensitive data is protected and to minimize the risk of compromise due to errors, accidents, natural disasters, or malicious actions.

While our security measures are extensive, you should always verify that you are accessing the website through a secure connection and avoid transmitting files over an unsecured network.

HTTPS

HTTPS (Hypertext Transfer Protocol Secure) is the method your web browser uses to connect securely to the website. SSL (Secure Sockets Layer) provides server authentication and data integrity through a digital certificate issued by a trusted authority. This digital certificate verifies the connection between the server’s public key and its identity, ensuring that you are not connecting to an impostor server.

Communication via HTTPS is secured with advanced encryption, preventing tampering or eavesdropping. Depending on your web browser, you may be able to request a security report to assess the strength of your connection.

You can confirm that you’re on a secure server by checking the URL. If it begins with https:// instead of http://, the connection is secure. Your browser will alert you if there is a problem with the website’s security certificate, in which case you should avoid logging in to ensure your connection is secure.

Infrastructure

The servers that host this website are located in separate data centers in the United States. To reduce the risk of disruption from a catastrophic event, these data centers are located hundreds of miles apart, connected to different network providers, and powered by separate grids. If necessary, service can be transferred between data centers within minutes.

Each data center employs extensive security measures, including:

• Man traps and biometric locks (two-factor authentication)
• 24-hour on-site security with escorted access
• Security cameras with digital recording and storage
• Sign-in/sign-out logs for all visitors
• Locked server cabinets

The facilities also offer continuous on-site support for uninterrupted operation:

• 24-hour remote support
• Battery backups
• Diesel generators
• Fire suppression systems

Some information sent by the website may be delivered via a Content Delivery Network (CDN), which distributes assets like images, videos, and scripts through local servers near your internet provider. Personal information, however, is never sent over the CDN for security reasons.

Backups

In addition to real-time data replication between the primary and secondary data centers, customer information is protected by regular backups. Dedicated archive servers at each facility store backups for all customer databases. These backups are automatically copied between data centers. We frequently test backups to ensure they are valid.

Backup retention includes:

• Incremental backups every few minutes for two weeks
• Full backups every week for two months
• At least one full backup each month for one year

All backups are compressed and encrypted using the Advanced Encryption Standard (AES), which is recognized as one of the most secure encryption methods and is used by the U.S. and Canadian governments.

Technical Safeguards

We have implemented several technical safeguards to ensure network and host security, as well as to manage server vulnerability. These include:

• DMZ (Demilitarized Zone): Houses servers that interact with the Internet.
• Firewalls: Dedicated appliances that control the flow of information to and from the DMZ.
• Defense-in-depth: A layered security approach to prevent direct attacks on critical systems.
• Intrusion Detection and Prevention Systems (IDPS): Detect attacks against the network.
• Server Hardening: Disabling unnecessary services and restricting server communications.
• Vulnerability Management: Regularly reviewing, testing, and deploying security patches.
• Antivirus and Antispyware Scanning: Applied to both servers and employee workstations.

Monthly vulnerability scans are performed to validate these security measures.

Secure Coding Practices

Our system security also depends on managing the Software Development Life Cycle (SDLC) effectively. Each phase of the SDLC includes security tasks to ensure that security is integrated throughout the development process. The SDLC requires that:

• Security impact is considered for each change.
• Security patches and configuration changes are tested thoroughly.
• Production and test environments are separate and have adequate access controls.
• Responsibilities for testing and production are clearly separated.
• Production data is not used for testing or development.
• User inputs are validated to prevent vulnerabilities.
• Errors are handled appropriately.
• Role-based access controls are consistently enforced.
• Communications are secure.
• Cryptography is applied to protect sensitive data where appropriate.
• Code changes are reviewed by knowledgeable personnel.
• Automated tools are regularly used to detect vulnerabilities.