Zebrium Service Security
Culture Based on Data Security.
Securing customer data is a critical part of our promise to customers. We understand how important data security and privacy are to our users.
The team behind Zebrium has decades of experience securely handling sensitive software logs and metrics for market leading enterprise products that are used by some of the most security conscious enterprises and government organizations. We have geared all aspects of our architecture, operations, and company culture to meet these expectations.
The purpose of this writeup is to provide our customers with a “plain English” description of some of the security protections we have in place. A more extensive, technical explanation is available in our infosec policy, which can be provided upon request.
Logical (and optionally physical) Separation of Customer Data.
All customer data is tagged with a unique token identifier per organization, and each organization is assigned a unique schema within the underlying database. All read/write operations rigorously enforce the mapping of organization to assigned schema and data.
For customers with additional security restrictions, we offer the option of hosting your service in a dedicated virtual private cloud (VPC) instance assigned exclusively to you. Since your data never leaves the dedicated VPC, this provides an additional layer of protection over and above logical controls. Please contact us if you have more specific requirements for the location of the service.
Encryption.
All customer interactions with the Zebrium service, including data upload, download and UI operations are encrypted using HTTPS and SSL.
All data at rest is encrypted using AES-256 encryption.
Single Sign-On Support
Zebrium supports most leading SSO providers via SAML including: Auth0, Azure, Duo, Jumpcloud, Okta.
Service Security.
All inter-node communication within the Zebrium service is locked down by only allowing communication between white listed nodes over a private subnet. SSH access to the service is only enabled for white-listed IP addresses.
Every code deployment automatically updates Zebrium nodes to include security updates from the latest version of Ubuntu Linux currently available.
The service regularly undergoes penetration testing by 3rd parties, with no vulnerabilities unresolved.
All logs from software components of the Zebrium service are themselves fed into and analyzed by another instance of the Zebrium service in order to uncover anomalous patterns.
Handling of Sensitive Data.
The Zebrium service supports the option of filtering out specific event types, for instance those containing sensitive fields such as IP addresses. One of the unique advantages of the Zebrium solution is the fact that all events in your logs are automatically and fully parsed, and all fields within them extracted and typed as variables. In the event that you accidentally upload customer sensitive data into our service, this capability means that we can support the clinical removal of such data.
Access by Zebrium Employees.
Access to production systems running Zebrium software will be subject to the following conditions:
- Access to systems is only allowed by an explicitly defined group of Zebrium operations employees
- Access to systems is allowed only when there is a specific operational need
- SSH access to the Zebrium service is only enabled for a whitelisted set of IP addresses and ports
- Admin actions via management console, CLI, or access to underlying cloud services is audited, and audit logs are retained for retroactive review.
Access to data will be subject to the same conditions as above, plus some additional restrictions:
- Access will only be permitted for the purposes of troubleshooting, technical support or testing, tuning and quality assurance of our service.
- Additional access will only be permitted with customer consent and only on and as-needed basis.
Physical Security.
- The Zebrium SaaS service is hosted in AWS datacenters with stringent security controls. Zebrium employees do not have physical access to these data centers.
- AWS data centers comply with the most rigorous security certifications including SOC 1, 2 and 3, PCI DSS 3.2 Level 1, ISO 27001, as well as FedRamp (select locations).
Customer Data.
The customer retains full ownership of all customer data stored in Zebrium systems. Upon termination of the Zebrium service (or upon request), all copies of customer data will be deleted.
Reports and 3rd Party Audits
Extensive testing and auditing by internal and external security experts are part of our commitment to our customers. Reports are available upon request.
- CAIQv4
- SOC 2 Attestation
- Most recent 3rd party penetration test report