Security

Data Protection

• Encryption in transit: every page is served over HTTPS, with HSTS so browsers keep to HTTPS on every later visit.
• Encrypted secrets: TOTP secrets, and the payment-processor API keys we store, are encrypted in the application with AES-256-GCM. Card numbers go to Stripe and never reach us.
• Backups: the database is backed up every night, and copies of the backups are kept off the application server.
• Data Processing Agreement: an organization admin accepts our Data Processing Agreement for the organization before any governance records can be created or changed. Organization setup (profile, members, sign-in and integration settings) can be done first.

Protected Health Information

• Our business associate agreement with you: an organization that says it is a covered entity or a business associate signs a business associate agreement with us before it answers assessments, attaches evidence or keeps any record that may hold protected health information; setting up the organization, registering its systems and starting an assessment do not wait. Our standard agreement, which you can read on our site, is signed by Backsplice in advance and takes effect when you sign it; or you can provide your own, which we review and countersign.
• Our own business associate agreements: we hold business associate agreements with our hosting provider, with our backup storage provider and with our email delivery provider.
• Watney and the model provider: Watney sends the model provider the records a task works on, and reads nothing of an organization's until an organization admin opts in. We have a business associate agreement with the model provider, with zero data retention: the provider does not keep what Watney sends it once it has answered, except where the law requires it. Watney's system card names the provider and the models. Separately, our staff have an assistant of their own for questions about the platform: it is off unless staff switch it on, and when it is on it can read records from any organization and send them to the same provider, whatever an organization's own setting is.

Authentication & Access Controls

• Multi-factor authentication: authenticator apps (TOTP) and passkeys.
• Single sign-on and provisioning: SAML single sign-on and SCIM user provisioning, with a paid plan.
• IP allowlist: each organization can restrict access to the IP addresses it allows.
• Role-based access: admin, contributor and auditor roles decide what each member can see and change.
• Sessions: session cookies are Secure, HttpOnly and SameSite=Strict.

Audit Log

Actions on the platform are written to an audit log in which each entry is hash-chained to the one before it, so a later change to a recorded entry is detectable unless it is made by someone holding the application's signing key and database access. That makes the log tamper-evident. It is not immutable, and we do not describe it as such. Entries are kept for six years; after two years they move to an archive that the audit log export still reads.

Incident Response

What we commit to if a personal data breach affects your data is set out in the breach notification section of our Data Processing Agreement, and for protected health information, in our business associate agreement.

Reporting a Vulnerability

We welcome vulnerability reports from security researchers and customers at [email protected]. Please include enough detail for us to reproduce the issue. Coordinated disclosure preferred.