v1.4 - December 29, 2024

‍

This document describes how Signitic meets the security principles presented by the National Cyber Security Centre (NCSC) document as well as the ANSSI SecNumCloud, including what is the responsibility of Signitic (the service provider) and what is the responsibility of the customer.

‍

DATA PROTECTION IN TRANSIT

All data transmitted between Signitic services is transmitted using strong encryption protocols. Signitic supports the latest recommended secure cipher suites to encrypt all traffic in transit, including the use of TLS 1.2 protocols, AES256 encryption, and SHA2 signatures where possible.

‍

ASSET PROTECTION AND RESILIENCE

All customer data resides entirely in our AWS production environment.

The data location is eu-west-3a, eu-west-3b, and eu-west-3c in Paris (FRANCE).

Signitic provides services in accordance with the laws applicable to it as a service provider.

Customers contract with Signitic SAS, a French company.

The following categories of customer data will be stored in a data center located in France:

• Files (images)
• Data (users, templates, etc.)
• Data used for the analysis and measurement of the quality of the service, for example, newspapers (sanitized newspapers).

‍

All customer data resides entirely in our AWS production environment. Physical protections are fully provided by AWS, which has a broad range of certifications and security clearances for its physical security. More AWS data center security data can be found here.

‍

By default, Signitic protects customer data as part of its core security controls. Signitic defines policies and standards that require media to be properly cleaned after they are no longer in use.

‍

The Significtic host is responsible for deleting data from the disks allocated for the use of Signitic before they are reused.

‍

Significtic hosts must ensure that hardware is disposed of in a responsible manner.

‍

Signitic uses the services deployed by its hosting provider to spread production operations across three distinct physical sites. These three sites are located in the same geographic region, but protect Signitic's service from connectivity losses, electrical infrastructure, and other common failures specific to each site. Les

production transactions are replicated between these distinct sites in order to protect the availability of the Signitic service in the event of a catastrophic location-specific event.

‍

Signitic also maintains a full backup copy of production data in a remote location that is far removed from the main operating environment location. Full backups are recorded in this remote location at least once a day and transactions are recorded continuously. Signitic tests backups at least quarterly to ensure they can be successfully restored. Additional physical resilience is provided by our hosting providers.

‍

SEPARATION BETWEEN USERS

Signitic is hosted in an Amazon Web Services Virtual Private Cloud (VPC). It is a multi-tenant solution where data is logically separated. Each API call at all layers of the tech stack uses an accountID as the primary key. When a user signs in to Signitic, the credentials are checked in our user database. This ensures that all user calls are directed to the correct account. Logical separation ensures that customers can only access their own data and that of no one else.

‍

GOVERNANCE FRAMEWORK

The Significtic Security Team, led by our Technical Manager, is responsible for implementing and managing our security program. The technical manager is supported by members of the Security Team at Signitic as well as security specialists from its parent company, who focus on security architecture, product safety, enterprise security operations, production safety operations, and risk and compliance.

‍

Signitic also has a Data Protection Officer (DPO). To contact our Data Protection Officer, please send an email to dpo@signitic.com.

‍

Signitic is constantly monitoring, verifying, and improving the design and operational effectiveness of its security controls. These activities are regularly carried out by accredited third-party evaluators and by the internal team at Signitic.

‍

OPERATIONAL SAFETY

The Github management tool is used to centrally manage Signitic's production servers throughout their lifecycle and to ensure that basic security configurations are consistently applied to all servers.

‍

The team will assess the risks and impact of the newly reported vulnerability on the Signitic production environment and determine appropriate remediation strategies accordingly, in accordance with Signitic's vulnerability management policy.

‍

Signitic's host, Amazon Web Services (AWS), is responsible for patching and correcting infrastructure flaws, as well as maintaining infrastructure configuration. For more information, see the AWS Shared Responsibility Model.

‍

Signitic maintains an internal vulnerability management program to identify and correct issues. Signitic runs vulnerability scanners that target internal and external endpoints.

‍

Signitic monitors servers, workstations, and mobile devices to maintain and analyze a comprehensive view of the security status of its business and production infrastructure. Administrative accesses, the use of privileged commands, and system calls on all servers on the Signitic production network are recorded. Log analysis is automated, where possible, to detect potential problems and alert. All production logs are stored in a separate network whose access is restricted to the personnel concerned.

‍

Signitic has established policies and procedures to respond to potential incidents. The procedures define the types of events that should be managed through the incident response process and categorize them according to their severity. In the event of an incident, affected customers are notified by email by our team. Incident response procedures are tested and updated at least once a year.

‍

DEVELOPMENT AND TEAM SECURITY

Signitic ensures that background checks are completed for everyone working at Signitic before they start working. These activities are carried out within the legal limits of local jurisdiction.

‍

Access to customer data is restricted to a select group of engineers. In the event of an employee being fired or departed, Signitic revokes all access to the system as soon as possible (always within 24 hours).

‍

Customers are responsible for recruiting and training their own staff, as well as for assigning the correct roles to users.

‍

Operational security at Signitic starts with our secure development lifecycle, which ensures that all new features released are reviewed prior to release into production. Signitic performs white, gray, and black box intrusion tests on an annual basis.

‍

SUPPLY CHAIN SECURITY

Significtic subcontractors (external providers who process customer data) are evaluated by the Signitic risk and compliance team to ensure that they are using adequate security controls in their respective environments. In the event that Signitic integrates another subcontractor, Signitic personnel conduct security reviews as part of the due diligence process. Signitic conducts annual risk assessments of secondary subcontractors to ensure that they adequately maintain their safety and compliance positions.

‍

IDENTITY AND AUTHENTICATION

Signitic provides customers with controls to manage their users and administrator users.

‍

Customers who contact our customer support (support) team are automatically identified.

‍

Customers are responsible for integrating and managing their identity provider (for single sign-on and provisioning) as well as for assigning roles in Signitic.

‍

Signitic uses role-based access control and each role has its own level of permissions and access.

Customers are responsible for managing the administrator accounts used to install applications connected to Signitic.

‍

Customers are responsible for integrating and managing their identity provider (for single sign-on and provisioning) as well as for integrating and excluding users (members and guests).

‍

SAML-based single sign-on (SSO) allows members to access Signitic through an identity provider.

For users who authenticate via SSO, your identity provider is responsible for enforcing the password policy.

‍

For users who authenticate via an email address, the password must have at least eight characters, one uppercase, one lowercase, one number, one special character. Protection against “brute-force” attacks is applied to each password login attempt (temporary and then permanent ban).

‍

EXTERNAL INTERFACE PROTECTION

Signitic sets up all access control lists (ACLs), security groups, and ports/protocols/services to deny everything by default and allow by exception. This ensures that Signitic only exposes the appropriate interfaces necessary for our customers to use the service, without unnecessarily expanding the attack surface. We use scanners and automated tools to verify that these resources are properly protected.

‍

Customers are responsible for integrating and managing their identity provider (for single sign-on and provisioning), boarding and disembarking users (members and guests), and assigning roles in Signitic.

‍

SECURE ADMINISTRATION OF SERVICES

The concept of least privilege is applied to all Signitic systems, as they are all capable of extending permissions based on a defined profile. Signitic uses a role-based access control (RBAC) model to assign access to system users.

‍

Signitic employees with access to the production environment, internal tools, and customer data are reviewed semi-annually to ensure that their access is appropriate based on their professional roles and responsibilities. Any anomaly (users no longer needing access) is treated accordingly.

‍

Access to the Signitic production environment requires users to connect to a host using SSH keys and two-factor authentication.

‍

Customers are responsible for managing administrator accounts as well as for communicating the terms of service related to access to their users.