Borealis technology
All hardware, network, and web applications are managed, constantly monitored, and regularly audited by Borealis and our designated Infrastructure-as-a-Service (IAAS) provider (OVH and AWS, two world-class cloud providers).
Infrastructure, network, and application protection
Hardened hosted infrastructure
- All production services are hosted at a Tier 3 certified design data center that is:
-
- ISO 27001:2005 certified;
- SOC 1 Type II (SSAE 16 and ISAE 3402) and;
- SOC 2 Type II compliant
- High availability servers with automatic failover capabilities
- Changes are monitored and reviewed for legitimacy and security patches are kept up to date
- Timely response to security incidents
Vulnerability Management
- Protected by enterprise grade firewalls, Intrusion Prevention & Detection System (IPS/IDS) and Protected against DoS/DDoS attacks
- Third-party vulnerability testing and support provides an additional level of security (Third party intrusion tests and Qualys reports are available upon request)
- Web application scanning system automatically identifies OWASP Top 10 risks
- Ongoing 24/7 monitoring of technical systems and infrastructure by Boréalis operations and support team
Business continuity and disaster recovery
Count on us to keep your application up and running.
Business continuity
- Scalable, distributed computing infrastructure provides essential redundancy
- Offsite mirroring of data and application
- Complete virtual server backups made on a daily basis
- Hot-site disaster recovery tests performed daily;complete disaster recovery diagnostic done quarterly.
Operational policies and processes
Business practices that are in line with the highest industry standards.
Operational policies
- Risk assessments conducted regularly
- All employees, partners and vendors required to sign and adhere to confidentiality agreements
- All client info treated as confidential and access is granted on a need-to-know basis
- Access enforced with policies to control all activities including user registration, access privileges and passwords
- Security-qualified and authorized Boréalis employees access the system using 2-factor authentication
- User host access, authentication level and login times are monitored and documented
Architecture, identity and access management
Count on us to keep your application up and running.
Administration controls
- Only application administrators are allowed to create users and assign data security rules
- All access is governed by strict password security policies with configurable complexity
- Access controls can be assigned by project, campaign, communication, group or role
- Document-level security ensures everyone has all the information they need while keeping sensitive data safe
Architecture
- Multi-tenant architecture allows all business units to share one installation and enables multiple configurations – corporate wide, site, partner, contractor, teams, etc.
- Multi-instances allow each business unit to further configure each instance for a different environment
- Data segregation within an instance with row-level access permissions enables complex user access configurations
Data Encryption
- All data transmissions and data at rest are fully encrypted using SSL and 256-bit AES technology
- Individual user sessions identified and re-verified at each transaction, with a unique token created at login
User access
- Supports several authentication protocols, including SAML single login and single logout and LDAP
Activity log
- All activities performed within the application are logged with Audit Trail
- All data exports are recorded as an activity with the date and user
Privacy
- Complies with General Data Protection Regulation (GDPR), including user consent, data retention, access and deletion.
