Effective: March 28th, 2018

Information Security Policy

  1. Overview

Information security is a serious matter for WillSuite. This policy serves as a guide to let you know the steps we take to ensure the privacy of your data.

  1. Data Centre Security

    1. WillSuite runs on the DigitalOcean platform with data hosted by the platform Amazon Web Services (AWS) in nondescript housed facilities. Our data centers are located in London.

    2. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication a minimum of two times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff.

    3. More information relating to security of data centers can be found in the AWS Security Whitepaper and DigitalOcean security disclaimers available here: https://aws.amazon.com/whitepa...
      https://www.digitalocean.com/s...

  2. Server Security

    1. Our server network can only be accessed via SSH with public key authentication or via Two-factor Authentication over SSL. Public keys are removed from servers where access is no longer required.

    2. Operating system security patches are checked on a nightly basis.

  3. Third Party Penetration Tests

    1. In addition to extensive internal scanning and testing, WillSuite work with CREST-accredited third-party security experts to perform a broad penetration test across the WillSuite platform to validate and improve on the security of our software.

  4. Ongoing Security Monitoring

    1. Servers are checked for security patches on a nightly basis.

    2. Automated application checks are ran against the PHP Security Advisories Database (https://security.sensiolabs.org/) every 24 hours. WillSuite are alerted if there are any packages included within the system which require action.

    3. WillSuite are notified when suspicious account activity is detected. In some cases access to the system may be automatically restricted until manual intervention by WillSuite employees.

  5. Encryption of Data

    1. Communications between you and WillSuite servers are encrypted via industry best-practice HTTPS and Transport Layer Security (TLS) by default.

    2. At rest, data is encrypted on our AWS platform with AES-256 encryption.

  6. Data backup and redundancy

    1. WillSuite’s strict backup regime ensures customer data is backed up on an hourly basis.

    2. Before being purged;

      1. Hourly backups are held for a period of 7 days.

      2. Daily backups are held for a period of 16 days.

      3. Weekly backups are held for a period of 8 weeks.

      4. Monthly backups are held for a period of 3 months.

  7. Data Retention

    1. Customer data is retained for as long as you remain a customer and until impractical, your data will remain in the WillSuite system indefinitely. Former customers’ core data is removed from live databases upon a customer's written request or after an established period following the termination of the customer agreement. In general, former customers’ data is purged 90 days after all customer relationships are terminated.

    2. Information stored in replicas, snapshots, and backups is not actively purged but instead naturally ages itself from the repositories as the data lifecycle occurs. WillSuite reserves the right to alter the data pruning period and process at its discretion in order to address technical, compliance, or statutory needs.

  8. Framework level security

    1. We use tools and techniques to protect against common security vulnerabilities. This includes escaping user-inputted data which is rendered to reduce the threat of Cross Site Scripting (XSS), CSRF tokens are used to minimize the risk Cross Site Request Forgery (CSRF), and use of PDO across the system to minimize the risk of SQL Injection.

    2. Protection against the above attack vectors is evaluated as part of our third-party security audits.

  9. Data Access

    1. Customer Support, Services, and other customer engagement staff with a need-to-know may request access to customer services on a time-limited basis. Requests for access are limited to their work responsibilities associated with supporting and servicing our customers. The requests are limited to just-in-time access to a specific customer's service for a 24 hour period.

    2. All access requests, logins, queries, page views and similar information are logged. Employee access is subject to daily review and at least semi-annual recertification to ensure authorized systems are within limits of employees' current roles.

  10. Employees

    1. All employees are subject to pre-employment checks compliant to the BS7858:2012 security screening standard including, but not limited to,

      1. Confirmation of name, date of birth and address

      2. Right to work validation

      3. 5 Year career history reference checks employment, self-employment and unemployment

      4. Independent verification of any career gap which exceeds 31 days

      5. Verified written character reference

      6. Education checks as appropriate

      7. Financial public record check: CCJ’s, insolvency, bankruptcy, IVA’s, undeclared address links & aliases.

      8. Terrorist financial sanctions list & company officer checks

      9. Basic Criminal Record Disclosure

      10. Certificate of screening & full audit file supplied when vetting is complete

  11. Security Training

    1. All employees receive security and incident response processes training within the first month of employment as part of the WillSuite security program along with role-specific follow-up training. All employees must comply with Non-Disclosure Agreements and Acceptable Use Policies before access to production networks and data.

    2. Employees are tested on their knowledge of different common attack vectors used within web applications and given training on risk minimization before and during development on the code base.

  12. Product Security Features

    1. Two Factor AuthenticationTwo Factor authentication is available for users of the system to protect their account in the event their password is comprised.

    2. Password PolicyWe enforce a password policy restricting complexity and uniqueness of passwords.

    3. Unobtainable Authentication Data
      Passwords are one-way hashed and salted using bcrypt, the recommended industry standard in one-way hashing. Passwords cannot be retrieved by any party.

    4. Communication EncryptionWeb traffic to our platform is forced over encrypted HTTPS and is authenticated using TLS 1.2 (a strong protocol), ECDHE_RSA with P-256 (a strong key exchange), and AES_256_GCM (a strong cipher).

    5. Role-based AccessRole-based user access, allowing administrators to restrict application and data access for certain users dependent on their role.