Sectri's security program is built on the same NIST and CIS Controls frameworks we help our customers implement. Use this page to review our security posture and request documentation.
Sectri's internal security controls are mapped to NIST CSF 2.0 and CIS Controls v8.1. These are the same frameworks we deliver to our customers, giving us direct, practical expertise in what strong implementation looks like.
We are happy to provide framework alignment documentation and control mapping information upon request.
A third-party security firm conducts regular full application and infrastructure penetration tests of the Sectri platform. There are no outstanding remediation actions.
We follow industry best practices for data security. All customer data is encrypted in transit and at rest. Customer data is stored and processed in the United States. Customer data is segmented and is not commingled with other customer's data. We are happy to provide more details about our data security practices upon request.
Access to customer data and internal systems is tightly controlled using a least-privilege model. Multi-factor authentication is enforced across all internal systems. Privileged access is logged and reviewed on a regular basis. We are happy to provide more details about our access control practices upon request.
Sectri is hosted on U.S.-based cloud infrastructure. Dedicated infrastructure is provisioned for each customer to minimize the risk of unauthorized access, data commingling, and cross-tenant impact. We work with best-in-class infrastructure providers that maintain their own rigorous security programs. No customer data is sold or shared with third parties. We are happy to provide more details about our infrastructure and subprocessors upon request.
We protect our platform and corporate network against external and internal threats. Edge security protection and DDoS mitigation are in place. Vulnerability patching follows a defined remediation SLA. We are happy to provide more details upon request.
We take application security seriously. Our development process includes secure coding practices, code review, and dependency management. Our CI/CD pipeline also incorporates automated static and dynamic analysis to help identify and remediate common web application vulnerabilities prior to deployment. Regular third-party penetration testing covers the full application layer. We are happy to provide more details upon request.
We maintain a documented incident response plan with defined roles, escalation procedures, and customer notification timelines. Tabletop exercises are conducted on an annual basis. We are happy to provide more details about our incident response program upon request.
Sectri maintains a comprehensive set of security and governance policies including information security, acceptable use, access control, vendor risk management, and data retention. Policies are reviewed on a semi-annual basis. Please contact us for more details.
We maintain a business continuity and disaster recovery plan to ensure continued operations in the event of a disruption. Regular encrypted backups are performed with tested restoration procedures. We are happy to provide more details about our BC/DR program upon request.
Security awareness training is provided to all staff to ensure awareness of current threats and best practices. Training covers phishing, social engineering, acceptable use, and incident reporting procedures.
Privacy of customer data is central to how we operate. We follow industry best practices and applicable privacy regulations. Customer data is never sold or shared with third parties outside of documented subprocessors.
Subprocessors