Security
Product Security
At Uptycs, we use Agile principles for a rapid software development lifecycle that emphasizes security throughout. This enables us to discover and remediate software or security issues earlier. Software patches are released continuously, with those impacting end users taking priority. Our continuous integration process, along with well-defined change management policies, allow us to respond rapidly to issues with security or functionality in a consistent and thorough manner. With these DevOps practices, Uptycs can achieve fast time to resolution.
Physical Security
The Uptycs production infrastructure is hosted in Cloud Service Provider (CSP) environments. As indicated under The Shared Responsibility Model, the physical and environmental security related controls for Uptycs production servers, which includes buildings, physical security measures, and access control, are managed by these CSP’s. Professional security staff restrict physical access at the perimeter and all data center entrances. Authorized staff must pass two-factor authentication two or more times to access the data center.
Corporate Security
All Uptycs personnel are subject to background checks upon employment and undergo annual security awareness training for technical and non-technical roles. Employee policy emphasizes each employee’s responsibility to help secure our customer data and company assets.
Uptycs requires transport level security for network access and individually authenticates users by way of a central identity provider. We also leverage two factor authentication wherever possible.
Data protection
Authentication and Access Management
End users may log in to Uptycs using an Identity Provider, leveraging Uptycs’ support for the Security Assertion Markup Language (SAML). This service will authenticate an individual’s identity and may provide the option to share certain personally identifying information with Uptycs, such as your name and email address to pre-populate our sign-up form. Uptycs’ SAML support allows organizations to control authentication to Uptycs and enforce specific password policies, account recovery strategies and multi-factor authentication technologies.
Protection of Customer Data
Data submitted to the Uptycs service by authorized users is considered confidential. This data is protected in transit across public networks and encrypted at rest. Customer Data is not authorized to exit the Uptycs production service environment, except in limited circumstances such as in support of a customer request.
All data transmitted between Uptycs and Uptycs’ users is protected using Transport Layer Security (TLS 1.2). If encrypted communication is interrupted, the Uptycs application is inaccessible. At rest the customer’s data is stored on encrypted disks. The data is encrypted using industry-standard AES-256 data encryption.
Access to Customer Data is limited to functions with a business requirement to do so. Uptycs has implemented multiple layers of access controls for administrative roles and privileges. Access to environments that contain Customer Data requires a series of authentication and authorization controls, including Multi-Factor Authentication (MFA). Users must first login to a VPN, the user must present a password and an authentication code. Once on the VPN the user must present ssh credentials to login. Access to those environments is monitored and logged for security purposes. Uptycs has implemented controls to ensure the integrity and confidentiality of administrative credentials and access mechanisms, and enforces full-disk encryption and unique credentials for workstations.
Uptycs monitors critical infrastructure for security related events by using the Uptycs security analytics platform, alongside a custom implementation of other open source and commercial technologies.
Compliance
Certifications, Attestations, and Frameworks
Uptycs maintains active SOC 2 Type II compliance. You can read more about SOC 2 here.
Laws and Regulations
Uptycs is a data processor and where processing is to be carried out on behalf of customers, Uptycs provide sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of applicable regulation and ensure the protection of the rights of the data subject. You can learn more about our privacy policy at https://www.uptycs.com/privacy-policy.
Changing or deleting your information
Once customer contract is terminated, Uptycs deletes or returns all the personal data to the customer after the end of the provision of services relating to processing, and deletes existing copies unless the applicable law requires storage of the personal data.
How long does Uptycs keep Personal Information
Data retention for customer depends on customer configuration. Data is destroyed within 45 days of no longer being required and in some circumstances, retain data for more than 45 days with the permission from senior executive. Disposal of confidential information is logged in order to maintain an audit trail.
Vendor Management
Uptycs leverages a number of third-party applications and services in support of the delivery of our products to our customers. The Uptycs Security Team recognizes that the company’s information assets and vendor dependencies are critical to our continuing operations and delivery of services. As such, Uptycs’ Security team has established a vendor management program that sets forth the requirements to be established and agreed upon when Uptycs engages with third parties or external vendors. These engagements are designed to assess the technical, physical, and administrative controls in place and to ensure they are commensurate with the expectations of Uptycs and its customers.
