Introduction

This document showcases our dedication to ensuring a secure user environment and maintaining compliance with industry best practices and standards.

System and Network Security

• Hosting and Infrastructure: Velosimo Connect is hosted on Amazon Web Services (AWS), a secure cloud services platform. AWS provides a robust, scalable, and secure infrastructure, with compliance certifications from multiple bodies across the globe. It offers us a wide range of data protection measures, including secure access, encryption, network firewalls, and intrusion detection systems.
• Firewalls and Intrusion Detection Systems: We have robust firewalls and intrusion detection systems (IDS) in place to protect our network and monitor any malicious activity. AWS's in-built security features further enhance these protections.
• Network Segmentation: We have implemented network segmentation within the AWS environment, isolating sensitive systems from other networks to minimize the risk of unauthorized access.
• Vulnerability Scanning and Patching: We conduct regular vulnerability scans and promptly apply the necessary patches. The AWS infrastructure enables us to apply these updates seamlessly without interrupting our service.

Data Protection

• Encryption: All data on Velosimo Connect, both in transit and at rest, is encrypted using industry-standard protocols. AWS's encryption services enhance our data protection capabilities.
• Data Backup: We perform regular backups of customer data, with data restoration procedures regularly tested. AWS's reliable and scalable storage services support these efforts.

Access Control

• Role-Based Access Control (RBAC): We have implemented RBAC within our platform to control access to sensitive data and systems based on job function, leveraging AWS's Identity and Access Management (IAM) services.
• Multi-Factor Authentication (MFA): MFA is enforced for all system administrators and is available to all users, adding an extra layer of security for user accounts.

Incident Response and Disaster Recovery

• Incident Response Plan: We have a comprehensive incident response plan in place, which is reviewed and tested regularly.
• Disaster Recovery Plan: Our disaster recovery plan, supported by the high availability and redundancy of AWS services, ensures business continuity in the event of a major incident.

Policies and Procedures

• Security Policies: We maintain documented security policies covering a range of areas, including acceptable use, password management, and incident response.
• Security Training: All employees undergo security awareness training upon hire and on a quarterly basis to keep them current with the latest security protocols and best practices. This is tracked and updated regularly using KnowBe4.

Compliance

• CCPA compliance: Velosimo Connect complies with all relevant data protection and privacy laws, including CCPA.
• Industry Standards: Our security practices align with recognized industry standards, including ISO 27001 and NIST 800-53, and we leverage AWS's infrastructure, which is certified against a range of global standards.