Trust and Security Portal
![Trust and Security Portal](/content/images/size/w1200/2023/10/DALL-E-2023-10-26-15.18.01---Illustration-of-a-peaceful-digital-landscape-with-soft-glowing-nodes-connected-by-gentle-links.-A-large-central-node-is-labeled--TRUST-.-Above-it--a-f.png)
Overview:
Welcome to The ComplianceAide's Trust Portal, specially designed for our API and services. This portal serves as your one-stop destination for gaining insights into our steadfast commitment to data protection, privacy, and regulatory compliance. Here, you will find exhaustive compliance documentation, answers to commonly asked questions about security and privacy, and an in-depth look into our stringent security measures. Our aim is to be transparent and build a trustworthy relationship with our clientele, offering you the assurance and information you require to be certain of our capabilities in safeguarding your data.
ComplianceAide doesn't store any data to prioritize user privacy and data security by design.
![](https://thecomplianceaide.ghost.io/content/images/2023/10/image-21.png)
AI
Prompt(s) and completions (output), your embeddings and your training data
· are NOT available to other customers.
· are NOT available to OpenAI.
· are NOT used to improve OpenAI models.
· are NOT used to improve any Microsoft or 3rd party products or services.
· are NOT used for automatically improving Azure OpenAI models for your use in your resource (The models are stateless, unless you explicitly fine-tune models with your training data).
Security Frameworks we follow
· Cyber Essentials
· NIST CSF
Risk Profile
· Third Part Dependence = Yes
· Hosting = Major Cloud Providers: Azure
Data Security
· Backups enabled
We conduct backups on a regular basis in the event of an incident that causes data loss.
· Data deletion
We do not save, store or retain user responses, policies, plans, POEMS, assessments or evidence beyond a 7 day period.
· Encryption-in-transit
All customer data is encrypted in-transit using TLS 1.2
· Physical Security
Physical security of our infrastructure is managed by Azure. For more information, please see this overview: https://learn.microsoft.com/en-us/azure/security/fundamentals/physical-security
Access Control
· Data access
Access to internal systems is granted based on the principle of least privilege and is reviewed on a regular basis.
· Logging
All important security events in our environment are monitored.
· Credential Security
We have a strong internal password policy that includes a requirement for MFA for accounts that do not support SSO. Passwords are stored in a company managed password manager.
Infrastructure
· 24/7 Status Monitoring
· Windows 365
Our endpoints utilize windows 365 enterprise VDI's and are hosted in Azure in multiple regions throughout North America.
· Azure
Our infrastructure is hosted in Azure in multiple regions throughout North America.
· Infrastructure Security
We utilize infrastructure-as-code techniques to securely deploy resources in our environment.
· Separate Production Environment
Customer data is not used in non-production environments.
Endpoint Security
· Disk Encryption
Full-disk encryption is used to protect employee endpoints and infrastructure in the cloud.
· Endpoint Detection & Response
All employee endpoints are protected with an advanced EDR solution.
· Mobile Device Management
All employee endpoints are centrally managed and secured using an MDM solution.
Network Security
· Firewall
We use both Firewalls and Cilium Network Policies (firewalls for Kubernetes) to monitor and control traffic in our infrastructure.
· IDS
Network activity is centrally logged and arbitrary detection logic has been defined to identify attackers and other anomalous behavior and generate alerts for further investigation.