Last updated 7 December, 2023
...
LivePreso also optionally makes last-line-of-defence backups of all data and assets using Google Cloud Platform. Cloud Platform security information can be found at https://cloud.google.com/files/Google-CommonSecurity-WhitePaper-v1.4.pdf
LivePreso does not currently store any information with any other third parties.
Are employees and contractors required to acknowledge and accept policies?
Yes.
Are employees and contractors required to sign confidentiality agreements?
Yes. However, contractors are generally not granted access to information to which confidentiality agreements could apply.
Are criminal records and/or background checks undertaken during recruitment and/or employment processes?
LivePreso requires that recruitment agencies provide background checks for any candidates being considered.
Are all personnel required to sign an Acceptable Use policy?
LivePreso does not have a specific Acceptable Use Policy, but all rules that govern use of the network and systems are covered in the employee contract.
Are documented procedures followed to govern change in employment and/or termination including for timely revocation of access and return of assets?
LivePreso has documented procedures to govern change in employment and/or termination. These procedures are actioned immediately.
Access control and data transmission
Is information transmitted in an encrypted (with at least AES-128 encryption or equivalent strength) format from endpoint-to-endpoint and only to authenticated and authorised individuals?
LivePreso uses end-to-end HTTPS for all communications. The exact encryption strength depends on the ciphersuite negotiated between server and client. Our client applications rely on their host browser for this negotiation. All modern browsers will use TLS1.2 with elliptic curve key exchange, RSA authentication, AES-128 encryption and SHA256 hashing.
Other than the authentication attempt itself, LivePreso web and mobile client applications require authentication for all requests.
Qualys SSL Labs’ SSL Report awards an A+ grade to LivePreso’s SSL configuration.
Is information encrypted at rest (storage)?
LivePreso's data classification policy requires that data must be encrypted at rest, either AES-256 or better (symmetrical) or RSA-4096 or better (asymmetrical) must be used. Where symmetrical encryption is used, approval must be sought if the AES-256 key is controlled by a third party (e.g. a "cloud" service).
Do you have effective controls to restrict access to information from other customers (e.g. there are dedicated servers to segregate data from other customer data)? If yes, please specify these controls.
LivePreso generates separate database and administration credentials for each deployment, meaning each is logically isolated. Additionally, all LivePreso application and database servers exist within mutually unroutable private subnets isolated into their own ‘virtual private clouds’, such that data is thoroughly isolated.
How do operational personnel authenticate to production networks?
A minimal, reviewed and historically logged set of users are allowed access to production machines. Access is via interactive shell over the SSH2 protocol. The only authentication method allowed is key-based, and employees are required to use passphrased keys.
Is the provisioning process of system access and privileges (addition, modification and removal) approved by responsible and authorised persons in a timely and auditable manner?
System access is controlled by a central machine-configuration service, whose configuration directives are stored in a version control system. This VCS history, in addition to logs kept by the configuration service, maintains a full history of all server account creations, updates and deletions.
Only authorised employees are able to push changes to the configuration service, and any such changes are reviewed by those employees.
Are system access and privileges reviewed at least half yearly for appropriateness?
Systems accounts are reviewed whenever an account configuration change is deployed, in addition to quarterly reviews.
Application accounts with access to administrative areas are reviewed on a schedule agreed upon with our customer, as this typically depends on customer security policies, the volume and turnover of accounts with such access, and the sensitivity of data those accounts can access.
Do you use separate physical and logical development, test and production environments and databases?
Production, staging, testing and development environments are all completely isolated. They do not share any resources, including database servers, application servers, and storage areas. They use separate credentials for access to all services. The production and staging environments are additionally separated into their own ‘virtual private clouds’.
Do you have capabilities to anonymise data?
LivePreso is able to anonymise data at user request in accordance with the GDPR.
How is this data used within the organisation?
After anonymisation, non-identifying data continues to be used for reporting and other purposes.
Do you support secure deletion (e.g. degaussing/cryptographic wiping) of archived or backed-up data?
LivePreso has a secure destruction policy for print and digital media.
Network and operation security
Do you have the following Network security controls:
Networks are segregated based on assessed risks into different logical network zones with suitable security gateway arrangements
Demilitarised zones for Internet or public facing systems
Separate Internet facing applications from backend databases. If yes, how? Are they separated physically or logically?
Internet facing applications are protected by web application firewall
Each deployment is separated into its own ‘virtual private cloud’. Within this, database and application servers sit in private subnets, unroutable from the public internet. The application servers can only be accessed on ports 80 and 443 via an Elastic Load Balancer, and on port 22 via two “Bastion Hosts” deployed in routable subnets. The database server is completely inaccessible from the outside world. Shared infrastructure such as our machine configuration server, package repository, and logging server are only accessible with a whitelisted set of IP addresses.
not currently store any information with any other third parties.
Are employees and contractors required to acknowledge and accept policies?
Yes.
Are employees and contractors required to sign confidentiality agreements?
Yes. However, contractors are generally not granted access to information to which confidentiality agreements could apply.
Are criminal records and/or background checks undertaken during recruitment and/or employment processes?
LivePreso requires that recruitment agencies provide background checks for any candidates being considered.
Are all personnel required to sign an Acceptable Use policy?
LivePreso does not have a specific Acceptable Use Policy, but all rules that govern use of the network and systems are covered in the employee contract.
Are documented procedures followed to govern change in employment and/or termination including for timely revocation of access and return of assets?
LivePreso has documented procedures to govern change in employment and/or termination. These procedures are actioned immediately.
Access control and data transmission
Is information transmitted in an encrypted (with at least AES-128 encryption or equivalent strength) format from endpoint-to-endpoint and only to authenticated and authorised individuals?
LivePreso uses end-to-end HTTPS for all communications. The exact encryption strength depends on the ciphersuite negotiated between server and client. Our client applications rely on their host browser for this negotiation. All modern browsers will use TLS1.2 with elliptic curve key exchange, RSA authentication, AES-128 encryption and SHA256 hashing.
Other than the authentication attempt itself, LivePreso web and mobile client applications require authentication for all requests.
Qualys SSL Labs’ SSL Report awards an A+ grade to LivePreso’s SSL configuration.
Is information encrypted at rest (storage)?
LivePreso's data classification policy requires that data must be encrypted at rest, either AES-256 or better (symmetrical) or RSA-4096 or better (asymmetrical) must be used. Where symmetrical encryption is used, approval must be sought if the AES-256 key is controlled by a third party (e.g. a "cloud" service).
How do operational personnel authenticate to production networks?
A minimal, reviewed and historically logged set of users are allowed access to production machines. Access is via interactive shell over the SSH2 protocol. The only authentication method allowed is key-based, and employees are required to use passphrased keys.
Is the provisioning process of system access and privileges (addition, modification and removal) approved by responsible and authorised persons in a timely and auditable manner?
System access is controlled by a central machine-configuration service, whose configuration directives are stored in a version control system. This VCS history, in addition to logs kept by the configuration service, maintains a full history of all server account creations, updates and deletions.
Only authorised employees are able to push changes to the configuration service, and any such changes are reviewed by those employees.
Are system access and privileges reviewed at least half yearly for appropriateness?
Systems accounts are reviewed whenever an account configuration change is deployed, in addition to quarterly reviews.
Application accounts with access to administrative areas are reviewed on a schedule agreed upon with our customer, as this typically depends on customer security policies, the volume and turnover of accounts with such access, and the sensitivity of data those accounts can access.
Do you use separate physical and logical development, test and production environments and databases?
Production, staging, testing and development environments are all completely isolated. They do not share any resources, including database servers, application servers, and storage areas. They use separate credentials for access to all services. The production and staging environments are additionally separated into their own ‘virtual private clouds’.
Do you have capabilities to anonymise data?
LivePreso is able to anonymise data at user request in accordance with the GDPR.
How is this data used within the organisation?
After anonymisation, non-identifying data continues to be used for reporting and other purposes.
Do you support secure deletion (e.g. degaussing/cryptographic wiping) of archived or backed-up data?
LivePreso has a secure destruction policy for print and digital media.
Network and operation security
Do you ensure that remote access is only possible over secure connections?
...
LivePreso uses a variety of logging and alerting mechanisms; all network devices log to a central logging server for later analysis. Additionally, machine–level metrics are reported and alarmed, and application– and OS–level metrics and events through the services Sentry and NewRelic.
Are regular network penetration and/or vulnerability scans performed?
Security scans and penetration testing are typically commissioned on a per-instance basis.
LivePreso customers that have performed penetration tests have commented on both the low number of issues identified and the proactive response in fixing those that are identified.
How are production networks segregated from other networks?
Each LivePreso customer is isolated in its own privately-addressed “Virtual Private Cloud” or “VNet”, with its own application and database servers. Production networks are therefore separated from other LivePreso networks and from one another.
Some data are temporarily stored in caching, queue synchronisation and other infrastructure servers shared between LivePreso customers; however, these are also isolated from other networks. Data are never stored long–term on these machinesand OS–level metrics and events through the services Sentry and NewRelic.
Are regular network penetration and/or vulnerability scans performed?
Security scans and penetration testing are typically commissioned on a per-instance basis.
LivePreso customers that have performed penetration tests have commented on both the low number of issues identified and the proactive response in fixing those that are identified.
How is system access logged, monitored and alerted?
...