Technical Support. Company shall provide support to Customer according to the terms of Company’s Service Level Agreement are incorporated herein by reference.
Company utilizes infrastructure-as-a-service from Amazon Web Services (AWS), one of the world’s premier cloud service providers, and is a trusted technology partner of international brands and government agencies. For a list of AWS Customer case studies, visit the AWS Case Studies Page.
The following is a high-level summary of the Company security and infrastructure framework hosted with AWS. For a comprehensive explanation of the AWS IaaS offering, please view the Intro to Security Processes Whitepaper.
The IT infrastructure that AWS provides to its Customers is designed and managed in alignment with best security practices and a variety of IT security standards, including:
In addition, the flexibility and control that the AWS platform provides allows Customers to deploy solutions that meet several industry-specific standards, including:
AWS provides a wide range of information regarding its IT control environment to Customers through white papers, reports, certifications, accreditations, and other third-party attestations. More information is available in the Risk and Compliance Whitepaper.
Physical and Environmental Security
Business Continuity Management
Network Security
AWS Identity and Access Management and Multi-Factor Authentication
Access to the Company cloud management console requires two-factor authentication using a password and a Time-based One-time Password (TOTP) security token. Individual servers are accessed through an SSH connection using a password encrypted private key. Company servers are networked within an AWS Virtual Private Cloud (VPC) effectively isolating network traffic between servers.
Data Security
All access to the database (including application access) requires authentication. Passwords stored in the database are obfuscated using a one-way cryptographic hash algorithm.
Network Monitoring and Protection against:
Company utilizes the following AWS services:
* As needed
AWS services status can be tracked at the AWS Service Health Dashboard.
Product Security
There are two distinct products in Company Application. The frontend and backend WebApp provides access to authorized users. The front end is a Customer facing portal for Customers to login and view information while the backend is a role-based system for admin and other backend users to view and perform their roles such as underwriting and approval.
Authentication
Company incorporates authentication protocols to prevent unauthorized access to the system. Authentication information is always transmitted encrypted using SSL. The authentication token consists of a unique login name and user defined password. Passwords are obfuscated from view as the user enters them. Users only have access to the system through the Company Application, which restricts access based on account login and assigned role associations.
Secure Transmission
Once authenticated to the system, all data requests from the application interface are validated with a secure key before data is transmitted. All data is transmitted through encrypted SSL connections.
Service Availability
Company employs a wide range of technologies, engineering expertise, and streamlined failover processes to guarantee business continuity. Services such as Core Functionality recovery management, offCore Functionality backup, and customizable run-book policies keep data protected and accessible at all times.
Company shall make the Work Product Available, as measured over the course of each calendar month during the Term, at least 99.5% of the time. “Available” means the Services are available and operable for access and use by Customer, Lenders and the Users over the Internet in conformity with the Specifications.
Support and Maintenance Services
Company shall provide to Customer all updates, bug fixes, enhancements, new releases, new versions and other improvements to the Services, including the Company Application, that Company provides at no additional charge to its other similarly situated Customers.
Company will respond to and make reasonable attempts to resolve all support questions or concerns sent to support@businesswarrior.com or phone calls made to (855) 294-2900, according to the priority/severity schedule below (as reasonably classified by Company), Monday to Friday during normal business hours of 8am to 8pm EST. The Company may require Customer to submit “support tickets” via an external or internal platform as provided by the Company. Generally, electronic support requests are not received via Slack, text messaging or other means.
Incident Response and Handling Purpose
To ensure that security incidents are addressed appropriately to protect Company Customer resources and data.
Policy
An incident is an event or series of events that comprise a threat to the security (i.e., confidentiality, integrity, availability) of Company’s systems or data. Sources of incidents include (but are not limited to) viruses, worms, and attacks from outside Company.
All security incidents are responded to immediately using a strategy of:
Procedures
Identify
The HD bears responsibility for the severity level assignment. In cases where the severity is unclear or ambiguous, the HD may err on the conservative side and assign it a level 1 severity.
The HD, IT Team, or a delegate documents the incident and responses to the incident. Items that should be recorded include:
Contain
The IT Team monitors the attack by tracking network and system activity and determines a suitable approach to contain the attack. Containment tactics may include blocking an IP address or port at the firewall, disabling a compromised account, stopping a targeted network service, or unplugging a network cable. Level 1 attack may require a complete and abrupt shutdown of one or more systems. Though this tactic should be used with caution, the HD and IT Team have the authority to apply this tactic during severe situations. Such actions should be discussed and reported to the President as timely as possible.
Recover and Investigate
The HD oversees the recovery of the affected systems and consults with the IT Team to determine an approach to the recovery.
Customer Notification
When required by law, Company will notify affected Customers of an incident within 72 hours through email or other electronic means.
