Cybersecurity – Solution Brief

This annual audit confirms the security and availability of the cloud-based, software-as-a-service (SaaS) version of Stonebranch Universal Controller (UC), as defined by the American Institute of CPAs (AICPA):

• Security — Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity’s ability to meet its objectives.
• Availability — Information and systems are available for operation and use to meet the entity’s objectives. Capturing how a company safeguards customer data and how well those controls are operating.

Stonebranch’s most recent SOC 2 Type II certification report is available upon request.

ISO/EIC 27001 is a widely recognized international standard that outlines best practices for information security management systems (ISMS). It specifies the requirements to establish, implement, maintain, and continually improve an ISMS within the context of the organization. It also includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization. The requirements set out in ISO/ IEC 27001 are generic and are intended to be applicable to all organizations, regardless of type, size, or nature. Stonebranch’s ISO/EIC 27001 certificate is available upon request.

GDPR is a legal framework for the collection and processing of personal information of individuals within the European Union (EU). This law is applicable across the EU and enhances data protection for individuals within the EU. The GDPR replaced the EU’s Data Protection Directive of 1995 and came into effect on May 25, 2018.

Stonebranch leverages Azure and AWS data centers in the United States, Europe, and Asia Pacific. Other locations are potentially available upon request.

All communications with the Stonebranch Universal Automation Center (UAC) interface and APIs are encrypted via industry standard HTTPS/TLS (TLS 1.3) over public and private networks. This ensures that all traffic between you and UAC application is secure during transit.

Application data is encrypted at rest in AWS using AES-256 key encryption.

All new vendors go through a vetting process to ensure they meet or exceed Stonebranch’s high standards for security, privacy, and confidentiality. Vendors commit their adherence to these policies by signing a security addendum. Stonebranch will not enter into a business relationship with any vendor until the vetting process is successfully completed and the security addendum is signed.

Stonebranch performs annual security reviews on all vendors with any level of access to our systems or service data.

Transport layer security (TLS) encryption is enabled by default on the web application access points. AWS Relational Database Service (RDS) databases for Universal Controller SaaS environments are set-up with both encryption in transit and at rest.

Security groups are set-up for each component — such as AWS EC2, RDS, and Application Load Balancer (ALB) — to only allow finite ports for specific IPs. Customers can choose to whitelist their IPs for Universal Controller web access.

• AWS Private Link: VPC Networking – AWS PrivateLink – Amazon Web Services is a connectivity service that allows secure communication between your Stonebranch VPC and other AWS Services and/or on-premises networks without exposing traffic to the public internet.
• Site-to-Site VPN: This option establishes a a site-to-site tunnel from the customer’s network to the Stonebranch virtual private cloud (VPC) to ensure a secure connection from the Universal Agents (UA) deployed from the customer to the OMS/Controller. Universal Agents from the customer’s end can be set-up with IP whitelisting and certificate-based authentication.
• IP Whitelisting: Customers can provide a list of IPs to be whitelisted at the Stonebranch VPC for accessing the Controller access or OMS Connectivity from Universal Agents.

• Backend server access is restricted and is available only to the Stonebranch cloud operations team.
• Password-based logins are disabled by default. All secure shell protocol (SSH) access must use key-based authentication.
• SSH ports are restricted and can be accessed only via Stonebranch office locations or Stonebranch internal virtual private network (VPN).

• Username and password credentials are required to gain access to the application. It is the responsibility of the customer to manage users and ensure secure passwords are used. The Universal Controller application allows you to setup password rules for local users.
• Customers can integrate with their onsite lightweight directory access protocol (LDAP) or Active Directory. Single sign-on (SSO) via security assertion markup language (SAML) can also be implemented as needed.

• Agents installed in each EC2 instance will continuously run anti-virus and malware scans while also running intrusion detection scans (IDS).
• This service is automatically updated with the newest security engines and definitions whenever a new vulnerability is discovered, allowing Stonebranch to provide a high level of security.

• Background checks are conducted on all new employees in accordance with local laws. These checks are also required for contractors. The background check includes criminal, education, and employment verifications.
• Stonebranch follows the principles of least-privileged access for all systems to make sure that no company or client personnel has access to any system that they do not specifically need to be able to access.

All new hires are required to sign non-disclosure and confidentiality agreements.

All employees participate upon hire and annually thereafter. All engineers receive annual secure code training. The security team provides additional security awareness updates via email, blog posts, and in presentations during internal events.