The Security and Compliance You Need. The Trust You Want.

Vodori partners with Amazon Web Services (AWS), a SOC 2 Type 2 and ISO 27001 certified data center that provides a high degree of availability and security for our software. AWS’s SOC 2 and ISO 27001 compliance requirements provide systematic evaluation of risks, threats, and vulnerabilities through a set of established controls. Read more on AWS data center controls https://aws.amazon.com/compliance/data-center/controls/. Physical and environmental security is handled entirely by Amazon and their vendors. Vodori employees do not have physical access to data centers.

Vodori is currently deployed across 6 different data centers within the United States and Europe. If you are interested in a Vodori subscription in a data center outside the U.S. and Europe, contact our Sales team https://www.vodori.com/contact-us.

All network traffic in and out of the Vodori platform is routed through a physical or software firewall. A Web Application Firewall (WAF) is used to protect against cyberattacks. Separately, a fully managed 3rd party Intrusion Detection System (IDS) and Intrusion Protection System (IPS) is deployed to continuously monitor network traffic and report and block suspicious activity. If suspicious activity is identified, it is logged and escalated within Vodori for review and triage. Additional AWS firewalls restrict access to our cloud systems by allowing only approved traffic and blocking all unauthorized connections

Vodori maintains documented security configuration standards, including secure images or templates, for authorized operating systems and software in the enterprise.

Patches and upgrades for non-critical vulnerabilities are remediated on a monthly basis as part of scheduled monthly maintenance. Environments deployed to cloud-provided virtual machines are based on environment templates developed by Vodori according to company hardening standards.

These environments are maintained with up-to-date patch levels by the engineering team.

The Vodori platform is built on a secure multi-tenant architecture hosted at AWS, where infrastructure is shared and customer data is logically separated, accessible only through strict access controls. 

Vodori customer data is logically isolated per customer—either through dedicated customer-specific access credentials or via Attribute-Based Access Control (ABAC), dependent on the Vodori product version. Files at AWS are encrypted at rest using a customer-specific encryption key. Data stored in AWS is encrypted at rest using customer-specific encryption keys and AES-256 encryption. 

Remote system administration access to Vodori web and application servers is available through cryptographic network protocols (i.e., SSH or AWS SSM) or an encrypted virtual private network (VPN) connection.

Customer data in transit to or from the Vodori platform is protected through either Hypertext Transfer Protocol Secure (HTTPS) over Transport Layer Security (TLS) or Secure File Transfer Protocol (SFTP).

Vodori uses a redundant, fault-tolerant database that is deployed across multiple availability zones, and Amazon’s highly available and highly redundant storage architecture. If one or more availability zones are unavailable for an
extended period of time, Vodori may choose to execute the Disaster Recovery Policy which allows instantiating a replica infrastructure in another AWS service region.

In production environments, daily backups will be kept for 7 days. Backups would be used in the event of a full system restoration in which the most recent backup would typically be restored to minimize the lost work from the backup point forward.

Vodori operates with a Recovery Point Objective (RPO) of 4 hours and a Recovery Time Objective (RTO) of 24 hours.

Secure disposal of customer data occurs in the event the customer relationship is terminated. At the close of a customer contract, data is returned to the customer and/or removed/destroyed from Vodori's systems within 30 days or as agreed-upon between Vodori and the customer. 

Production backups are excluded from this timeframe as they will be retained for an additional 7 days following data deletion activities as they are systematically aged off in accordance with our backup and retention policies.

Access to customer data by Vodori personnel is restricted to only authorized Vodori personnel. All production data access at AWS is logged and reviewed on a regular basis.

To support our customers and end-users, the following teams have access to each customer-assigned Vodori environment:

• Customer Success Manager(s)
• Implementation Specialist(s)
• Support Analyst(s)

Customers are able to view, report, and modify this access using Vodori’s User Management solution. Data is not stored or retained by Vodori employees.

Internal access to customer tenants and production is reviewed quarterly. Additionally, a managed detection and response platform is enabled and uses AI to alert internal Vodori teams if there is unusual behavior in production.

Prior to engaging any third party sub-processor, Vodori performs diligence to evaluate their privacy, security and confidentiality practices, and executes an agreement implementing its applicable obligations to ensure they adhere to the same standards as Vodori to protect your Personal Information against unauthorized access, alteration, disclosure, destruction or loss. 

Sub-processors and all other high risk vendors are assessed annually thereafter to ensure there are no material security, privacy, or operational risks with the provided services.

The Vodori platform’s SSO is based on industry standards SAML and OAuth2/OpenIDC for managing user authentication. Our SSO is able to integrate with third-party SSO providers such as: Microsoft Azure Active Directory, Google Apps, PingFederate, Auth0, and Okta. Vodori’s SSO has additional security controls such as brute force protection, bot detection, and suspicious IP blocking.

For customers who do not integrate with their own SSO provider, the Vodori platform authentication enforces user multi-factor authentication (MFA). For 3rd party SSO providers, the customer is responsible for enforcing MFA.

Vodori platform access is granted based on standard and configurable roles and groups to meet your organization’s specific needs. In addition, the system has a configurable total session and idle session timeout, which requires users to re-authenticate after a given period of time.

External penetration testing is conducted by a third party annually.

Vodori conducts vulnerability scanning prior to considering an application ready for production use and after any significant changes in the application code. All Vodori builds include an integrated code and framework dependency security check. Whenever possible, Vodori will remediate identified Critical and High risk issues but may choose to defer remediation of a vulnerability if there is either no fix available or it has been determined that the system is not impacted by the specific issue. Each exception is documented in Vodori’s Ticket System and signed off by the CTO. Vulnerabilities identified as medium- or low-risk will be reviewed and addressed as needed. Further, all of our applications are security scanned so that bundled middleware is checked for known security issues.

All applications and middleware have monitoring in place to observe and detect issues with responsiveness, resource utilization, runtime instrumentation, or to detect general errors.

Vodori leverages five main types of monitoring:
• Application exception logging
• Application runtime logging
• Application runtime performance monitoring
• Infrastructure resource monitoring
• Network intrusion detection monitoring

Each type of monitoring configures critical alert categories that lets the Vodori team understand if there are issues which are impacting customer access, performance, system integrity, or Vodori's ability to deliver service per the SLA.

Vodori has designed and implemented a secure Software Development Life Cycle based on good practice guidelines (GxP) which integrates comprehensive security practices from start to finish. We build our products using the “Security by Design” principles, a process and mindset that anticipates security features through the entire development process.

Vodori engineers develop using test data and do not use production customer data. Vodori requires that all code merged into production code branches are reviewed and approved via a Pull Request and that code reviews follow Vodori’s Code Reviews standards. Vodori tests in a separate test environment, within a separate AWS account, so that production and customer data is separated from test data.

Quality Assurance is integrated into our process, from individual code changes all the way through preparing a release for our customers. Each feature or change developed in the Vodori platform is tested using a combination of unit, integration, and regression test scripts as appropriate. All releases of Vodori undergo rigorous regression, security and validation testing prior to release.

As each release date nears, your Customer Success Manager will work with your team to discuss the newly available features and determine when your organization would like to upgrade. Each release is accompanied by a validation deliverable package evidencing our procedures. Upgrades are done first in your sandbox to enable your team to perform the desired level of acceptance testing or formal software validation. Once approved, your production environment is upgraded. 

After configuration specifications are approved by the customer, the configuration is implemented and tested in the customer’s validation tenant. During User Acceptance Testing, the customer verifies the configuration has been completed according to the approved configuration specification and provides their approval. Once the configuration is approved and any customer dependencies are met, engineering promotes the configuration to the customer’s production tenant.