Here at Welkio Access, we take security and data integrity very seriously -- meaning protecting our customers' data is of the utmost importance. That’s why Access uses leading industry standards to ensure your information is safe and private.
How is my data saved and stored?
Our servers are hosted on the secure Amazon Web Services platform, and our server cluster is hosted in its own secure Virtual Private Cloud -- preventing unauthorized network access from outside sources.
Backup and versioning policies ensure your data is never lost. Our databases are continuously backed up every minute, and our media storage uses versioning policies that allow retrieval of deleted files, if necessary.
We always use the latest patches available for our technologies. Access participates in a vulnerability management and bug bounty platform to reward those who find and report bugs in our platform. Those bugs and vulnerabilities are then discreetly reported to Access and immediately addressed.
Note: Amazon data centers have been accredited under:
SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II)
PCI Level 1
For more information, visit https://aws.amazon.com/security.
Who can access my data?
Our employees cannot access your data without your explicit authorization, and all access to our servers and data is logged.
Strict policies ensure production data is only accessed for debugging issues that are only reproducible in production environments. Multi-party authentication is required to access that production data.
All Access employees are required to use two-factor authentication for any Access-related services -- with the exception of our customer support service. This includes personal services such as email as well as production services like Twilio (for SMS delivery).
How is my data protected?
HTTPS / SSL is enforced on all network connections to all Access servers.
This prevents your data from being sniffed (spied on, read) while in transit.
All sensitive data is protected with strong AES encryption.
Our databases use at-rest AES-256, block-level storage encryption.
In the unlikely event of a physical breach of our underlying infrastructure (i.e., if someone broke into the data center and removed the disk drives), your data would remain safe and secure.
Encryption keys are regularly rotated.
All passwords are one-way hashed and salted.
We can only reset a password, not retrieve it.
This makes password dictionary and brute-force attacks less effective.
In the unlikely event of a database breach, passwords will be very difficult and time-consuming to crack.
Sensitive data on Amazon S3 is retrieved via access tokens that expire after 5 minutes.
This protects your data from being shared with parties outside of your organization should a media link fall into the hands of an unauthorized party.
If you have any questions, or encounter any issues, please contact us at firstname.lastname@example.org.