Security
Here’s how Backboard secures data with encryption, access controls, monitoring, incident response, and strict retention and deletion policies. Built on AWS with audited controls, it supports our SOC 2 program, along with reliability, transparency, and enterprise-grade security.
Security controls
70 controls are monitored continuously, grouped below. Each one is tracked in our compliance platform and shown here as it is published in the trust center.
- Encryption key access restricted
The company restricts privileged access to encryption keys to authorized users with a business need.
- Unique account authentication enforced
The company requires authentication to systems and applications to use unique username and password or authorized Secure Socket Shell (SSH) keys.
- Production application access restricted
System access restricted to authorized access only
- Access control procedures established
The company's access control policy documents the requirements for the following access control functions:
- adding new users;
- modifying users; and/or
- removing an existing user's access.
- Production database access restricted
The company restricts privileged access to databases to authorized users with a business need.
- Firewall access restricted
The company restricts privileged access to the firewall to authorized users with a business need.
- Production OS access restricted
The company restricts privileged access to the operating system to authorized users with a business need.
- Production network access restricted
The company restricts privileged access to the production network to authorized users with a business need.
- Access revoked upon termination
The company completes termination checklists to ensure that access is revoked for terminated employees within SLAs.
- Unique network system authentication enforced
The company requires authentication to the "production network" to use unique usernames and passwords or authorized Secure Socket Shell (SSH) keys.
- Remote access MFA enforced
The company's production systems can only be remotely accessed by authorized employees possessing a valid multi-factor authentication (MFA) method.
- Remote access encrypted enforced
The company's production systems can only be remotely accessed by authorized employees via an approved encrypted connection.
- Intrusion detection system utilized
The company uses an intrusion detection system to provide continuous monitoring of the company's network and early detection of potential security breaches.
- Log management utilized
The company utilizes a log management tool to identify events that may have a potential impact on the company's ability to achieve its security objectives.
- Infrastructure performance monitored
An infrastructure monitoring tool is utilized to monitor systems, infrastructure, and performance and generates alerts when specific predefined thresholds are met.
- Network segmentation implemented
The company's network is segmented to prevent unauthorized access to customer data.
- Network firewalls reviewed
The company reviews its firewall rulesets at least annually. Required changes are tracked to completion.
- Network firewalls utilized
The company uses firewalls and configures them to prevent unauthorized access.
- Network and system hardening standards maintained
The company's network and system hardening standards are documented, based on industry best practices, and reviewed at least annually.
Related
- Privacy policyHow we handle personal information
- Terms of serviceThe agreement for using Backboard
- StatusUptime of the API and the public site