Effective Date: June 20, 2024
At Sync2Hire, we are dedicated to ensuring the security and integrity of our services. This Security Practices Policy outlines the measures we take to protect your information and maintain the security of our systems.
1. Security Governance
- Security Team: We have a dedicated security team responsible for implementing and maintaining our security program.
- Policies and Procedures: We maintain comprehensive security policies and procedures that govern our practices and are regularly reviewed and updated.
2. Data Protection
- Encryption in Transit: We use strong encryption protocols to protect data in transit and at rest. This includes the use of TLS (Transport Layer Security) for data transmitted between our servers and your devices.
- Encryption at Rest: Sensitive data stored in our database is encrypted using AES (Advanced Encryption Standard).
- Access Controls: We implement strict access controls to ensure that only authorized personnel have access to sensitive information. This includes multi-factor authentication (MFA) and role-based access controls (RBAC).
- Strong Password Policies: We enforce strong password requirements and regular password changes.
- OAuth/OpenID Connect: We use OAuth or OpenID Connect for secure user authentication.
- Least Privilege Principle: Users and systems have the minimum level of access required to perform their tasks.
- Data Segregation: We ensure that customer data is logically separated and segregated to prevent unauthorized access.
3. Data Backup and Recovery
- We perform regular back up of our customer data to secure offsite locations as part of our disaster recovery plan.
4. Infrastructure Security
- Secure Hosting: Our services are hosted on secure servers with robust physical and network security measures, including firewalls, intrusion detection systems, and regular vulnerability assessments.
- Monitoring and Logging: We continuously monitor our systems for suspicious activity and maintain logs to detect and respond to potential security incidents.
5. Application Security
- Secure Development: We follow secure coding practices and conduct regular security assessments, including code reviews and penetration testing, to identify and mitigate vulnerabilities in our software.
- Static and Dynamic Analysis: Static and dynamic analysis tools are used to find and fix security issues in our code.
- Third-Party Security: We assess the security practices of third-party service providers and integrate security requirements into our contracts to ensure that they meet our security standards.
- Secure Integrations: Secure methods are used for integrating with third-party services.
6. Secure APIs
- API Security: API gateways and OAuth tokens are used to secure API endpoints.
- Rate Limiting: Rate limiting is implemented to prevent abuse of APIs.
7. Incident Response
- Incident Management: We have an incident response plan in place to quickly and effectively address security incidents. This includes defined procedures for identification, containment, eradication, and recovery.
- Notification: In the event of a security breach that affects your data, we will notify you promptly and provide you with relevant information and updates as we work to resolve the issue.
8. Employee Security
- Background Checks: We conduct background checks on employees in accordance with applicable laws and regulations to ensure a trustworthy workforce.
- Security Training: All employees receive regular training on security policies, best practices, and their responsibilities in protecting customer data.
9. Physical Security
- Access Controls: Our data centers and offices are protected by physical access controls, including biometric scanners, security guards, and surveillance systems.
- Environmental Controls: We implement environmental controls, such as fire suppression systems and climate controls, to protect our infrastructure from physical damage.
10. Business Continuity and Disaster Recovery
- Redundancy: We design our infrastructure with redundancy and failover capabilities to ensure high availability and resilience.
- Disaster Recovery: We maintain a disaster recovery plan to ensure the continuity of our services in the event of a major incident. This includes regular testing and updates to the plan.
11. Compliance
- Regulatory Compliance: We comply with applicable laws and regulations regarding data protection and security. This includes regular audits and assessments to ensure adherence to industry standards and best practices. We adhere to rigorous security measures and maintain compliance with GDPR, CCPA, and HIPAA to ensure the protection of your personal information.
- Penetration Testing: Periodic penetration tests are conducted to identify and fix security vulnerabilities.
- Certifications: We pursue and maintain relevant security certifications and attestations to demonstrate our commitment to security.
12. Customer Responsibilities
- Account Security: Customers are responsible for maintaining the security of their account credentials and for implementing appropriate security measures on their devices.
- Reporting Security Issues: We encourage customers to report any security issues or concerns to us immediately at customersupport@sync2hire.com.
13. Changes to This Security Practices Policy
We may update this Security Practices Policy from time to time. We will notify you of any changes by posting the new policy on our website. Your continued use of our services after such changes constitutes your acceptance of the revised policy.
14. Contact Us
If you have any questions or concerns about this Security Practices Policy, please contact us at customersupport@sync2hire.com.
By using Sync2Hire, you acknowledge that you have read, understood, and agree to this Security Practices Policy.
