Security at Extraflow
See how we protect customer data today and follow the progress of our compliance programs. We believe trust starts with a clear account of what is in place and what is still underway.
Compliance overview
Our work across security standards and data protection requirements.
- In progress
GDPR alignment
Aligning our data protection practices with GDPR requirements.
- In progress
ISO 27001:2022
Preparing our information security management system for ISO 27001 certification.
- In progress
SOC 2 Type II
Preparing for a SOC 2 Type II audit.
Security posture
An overview of the security practices we use to protect customer data. Contact us for details or supporting documentation.
Data
File system encryption
Sensitive storage uses block-level encryption.
Encryption in transit
Data sent over the public internet is encrypted using industry-standard protocols.
Cloud file storage encryption
Cloud file stores use server-side encryption.
Data retention
Customer data retention follows documented periods and applicable requirements.
Data classification
Company and customer data is classified according to our data classification policy.
Cloud security
Host hardening
Our host hardening baseline applies to virtual machines and containers.
Infrastructure as code
Infrastructure changes are managed as code and follow review and automated testing.
Firewalls
Network traffic is restricted to what systems need to operate.
Patch management
Operating system and container image updates are applied at least weekly.
TLS endpoints
TLS configuration is reviewed and weak endpoint grades are addressed.
Capacity management
We monitor system capacity and plan for additional demand.
Cryptography
Encryption at rest
Data stores are configured to encrypt data at rest.
Encrypted remote access
Authorized employees access production systems through approved encrypted connections.
Incident response
Incident management
Security and privacy incidents are logged, tracked, resolved, and communicated according to our response procedures.
Breach response
Policies and procedures cover data breach response and notification.
Data classification
Secure disposal
Customer data is securely disposed of after its retention period, subject to applicable exceptions.
Access, correction, and erasure
Processes support requests to access, correct, or erase personal data.
Pseudonymization
We assess and apply pseudonymization where needed.
Encrypted portable media
Portable and removable media is encrypted when used.
Monitoring
Security event review
Security events are triaged and reviewed for unauthorized or malicious activity.
Security event logging
Systems are configured to monitor security-related events.
Centralized logging
Application and system logs are sent to a central repository where possible, with controlled access and defined retention.
Access control
Single sign-on (SSO)
We use SSO for sensitive systems where available.
Password management
Privileged users use a password management solution.
Least-privilege access
Access to sensitive systems is granted according to business need.
Role-based access control
Defined roles separate access privileges across data and systems.
Access requests and approvals
Access requests are documented and approved before access is granted.
Administrative access
Administrative privileges are limited to personnel with a defined business need.
Multi-factor authentication
Sensitive systems require MFA.
Password configurations
Password settings follow our password configuration policy.
Customer data access reviews
Access to customer-confidential systems is reviewed quarterly.
System access reviews
Access to in-scope systems is reviewed quarterly and follow-up actions are tracked.
Remote access MFA enforced
Remote access to production systems requires MFA.
Application security
Source control
Source code and documentation are managed in version control with access restricted to authorized personnel.
Static code analysis
Source code is scanned for vulnerabilities using static analysis.
Encryption guidance
We document how appropriate cryptographic methods are selected and configured.
Need more detail?
Contact us with your security questions or requests for supporting information.
Contact ExtraflowFor data handling details, see our Privacy Policy