Data Security Attributes
What is data security?
The security of data refers to the process of preventing unauthorized access to it and ensuring its integrity throughout its life cycle. Encryption, hashing, tokenization, and key management techniques secure data across applications and platforms. For example, using encryption to prevent hackers from using your data if it is breached.
- Authorisation token-based security: Signzy uses the loop-back frameworkβs inbuilt access token generators for authentication methodology.
- End-to-end encryption: Signzy uses SSL for encrypting the entire channel.
- Transport Layer Security (TLS): Signzy has implemented TLS versions 1.2 and 1.3.
- Encryption on the Media Storage Container: Signzy uses the container to back up our media data as encrypted. Where all the uploaded data is encrypted, and the long chain of unguessable endpoints is generated.Β
We have below data purging methods:Β
- API-based data purging: A delete API can be called to purge the data in place.
- TTL-based data purging: We can implement a configurable TTL feature to purge data over time, as we can define TTL in 15 minutes and longer.
Signzy uses Multi-Factor Authentication (MFA) and Intranet (VPN) to protect our administration board which enhances an additional level of security to the platform.
Signzy uses Server & Application level protection to protect the types of rate limit attacks. We can configure certain security features which provide additional security, such as :
- Automatic password expiration functionality.
- Connection failure limit which blocks the user account after some erroneous attempts.
- Two-factor authentication functionality.
As there is IP-table DOS protection on the server level, all login endpoints are safe from rate-limit attacks.Β
At the API and application level, Signzy has numerous safety metrics. Some of them are detailed below.
- X-XSS Protection
- Cross-Origin Resource Sharing (CORS)
- Content-Security-Policy
Most HTTP requests are encrypted within the application, so manipulation of requests cannot be possible. This makes the application safer and more reliable.Β Additionally, concurrent sessions are not permitted, which makes the product more sustainable.
Signzy ensures the third-party Application Penetration Testing & Source Code Testing of Video KYC products at least annually from Cert-in empanelled vendors to ensure the supreme security of our product platform.
Additionally, the Signzy Information Security team performs monthly penetration testing as per the OWASP Top 10 standards along with Automated Vulnerability Assessment with licensed Nessus professionals & source code reviews at every major release to ensure information security.
Signzy ensures data security during transit and at rest. For the data at rest, we support disk level encryption (SSE with PMK) with AES256 algorithm, and for data in transit all communications-client device to server, server to server, or Signzy server to any requisite external service happen only over strong cipher TLS 1.2+ channel encryption with a minimum of 2048 bit RSA key over SHA 256 hash algorithm. PKCS #1 SHA-256 with RSA Encryption algorithm used as Certificate signature algorithm.Β
Getting help
Please feel free to contact us if you have any questions, require clarification, or have ideas for how to make the documents or any of our services better.
You can reach out to us at [email protected].
ο»Ώ