Sophus controls
As part of our security program, Sophus has implemented a range of controls to maintain compliance.
Product Security (7)
Production System User Review
Sophus’ Information Security Committee conducts an annual evaluation and authorization of personnel with access to the production console to ensure security and compliance.
Awareness for Incidents
Sophus maintains a comprehensive log of information security incidents, documenting investigation details and
response actions in accordance with established incident management policies and procedures.
response actions in accordance with established incident management policies and procedures.
Vulnerability Remediation Process
Sophus proactively identifies and addresses platform vulnerabilities through regular and systematic vulnerability scans.
Centralized Management of Flaw Remediation
Sophus monitors and mitigates all identified vulnerabilities, adhering to defined policies and procedures for vulnerability management.
Audit Logging
All user activities and system events are systematically logged and made available for monitoring, review, and audit purposes.
Data Security
- All stored data (including databases and attachments) is encrypted using AES-256-bit encryption, with
encryption keys managed through AWS services and rotated annually. - All data transmitted over networks is encrypted using HTTPS with TLS 1.2 or later.
Single Sign-On
Sophus has implemented SSO to facilitate secure and streamlined application access.
Data Security (16)
Identity Validation
Sophus enforces logical access provisioning for critical systems, requiring explicit approval from authorized personnel based on role-based or need-based criteria.
Termination of Employment
Sophus ensures the immediate revocation of logical access for employees upon termination.
Production Database Access Restriction
Sophus limits production database access strictly to personnel whose roles necessitate such privileges.
Multi-Factor Authentication
Sophus mandates multi-factor authentication for all personnel accessing critical systems to enhance security.
User Privileges Reviews
Senior Management or the Information Security Committee periodically reviews and ensures that access to critical systems is restricted to necessary personnel only.
User Access Reviews
Senior Management or the Information Security Committee conducts periodic reviews to ensure administrative accessvis appropriately restricted.
Encryption of Data at Rest
Sophus implements robust cryptographic mechanisms to encrypt all production databases storing customer data.
Infrastructure Asset Inventory
Sophus maintains a documented and updated inventory of organizational infrastructure assets to ensure accountability and security.
Data Backups
Sophus performs regular backups of user and system data to meet recovery objectives and verifies backup integrity.
Reliability and Integrity Testing
Sophus routinely tests backup data to validate media reliability and data integrity.
User Consent and Compliance
Sophus ensures compliance with regulatory requirements by obtaining user consent before processing personal data.
Data Subject Access Requests
Sophus processes Subject Access Requests in accordance with its Privacy Policy and applicable regulations.
Backup Implementation
Daily backups of primary data are conducted, stored in a separate location, and can be restored in alignment with recovery objectives.
Data Encryption at Rest
All stored data is encrypted using AES-256-bit encryption, with encryption keys managed through AWS services and rotated annually.
Data Encryption in Transit
All transmitted data is encrypted using HTTPS with TLS 1.2 or later.
Physical Security Measures
All customer data is securely processed within AWS infrastructure, adhering to industry-standard physical security controls.
Network Security (9)
Impact Analysis
Sophus evaluates system-generated information to assess its impact on internal controls and security posture.
Network Connection Restrictions
Sophus enforces strict controls to limit public internet exposure for production database and Secure Shell (SSH) access.
External System Connections
All production systems are protected by firewalls with deny-by-default rules, enforced through Sophus’ cloud provider.
Confidentiality in Data Transmission
Sophus employs strong encryption protocols, including HTTPS with TLS, to ensure the confidentiality of transmitted data.
Anomalous Behavior Detection
Sophus configures its infrastructure to analyze audit logs for identifying suspicious activities and potential threats.
Capacity & Performance Monitoring
Sophus continuously monitors critical assets to optimize performance, plan for future capacity, and mitigate denial-of-service risks.
Protection of Data in Non-Production Environments
Sophus ensures that customer data used in testing environments receives the same level of security as production data.
Centralized Security Event Logging
Sophus configures infrastructure to generate and store audit logs for all critical security-related activities.
Virtual Private Cloud Implementation
Sophus utilizes AWS as its exclusive hosting provider, ensuring all data remains within a secure Virtual Private Cloud (VPC).
Application Security (7)
Privacy Notice Accessibility
Sophus ensures that the most current privacy-related information is readily accessible to customers on its website.
Secure System Modifications
Sophus adheres to structured protocols for securely modifying its operational environment.
Change Approval Procedures
Sophus has established formalized procedures to ensure all system modifications are thoroughly reviewed and approved before implementation.
Unauthorized Activity Monitoring
Sophus utilizes Sprinto for continuous security monitoring, providing alerts on unauthorized access level changes for team members.
Code Analysis & Vulnerability Detection
Sophus employs GitHub Dependabot for automated static code analysis to identify vulnerabilities and dependency risks.
Secure Software Development Life Cycle
Sophus follows a secure SDLC framework, ensuring that new feature releases adhere to best security practices without compromising existing applications.
Patch & Vulnerability Management
Sophus remediates identified vulnerabilities within defined timeframes based on severity levels, ensuring timely patching and software updates after rigorous testing.
Corporate Security (8)
Code of Business Conduct
Sophus maintains a well-documented policy outlining behavioral standards and ethical business practices.
Organizational Structure & Governance
Sophus implements a structured framework to define authorities, facilitate information flow, and assign responsibilities.
Clear Roles & Responsibilities
Sophus establishes transparent communication procedures to ensure staff understand their security-related responsibilities.
Competency-Based Hiring
Sophus ensures that security-sensitive positions are staffed with appropriately qualified professionals.
Personnel Security Screening
Sophus conducts security screenings prior to granting personnel access to critical systems.
Security & Privacy Training
Sophus provides role-specific security and privacy awareness training to all staff.
Performance Evaluations
Sophus assesses employees in IT, engineering, and security roles based on their responsibilities and contributions.
Incident Response Training
Sophus ensures all employees are educated on incident response protocols, covering triage, containment, eradication, and recovery procedures.