Thales Data Protection on Demand (DPoD) has been independently audited and received certifications for FIPS 140-2 Level 3, ISO 27001, and SOC Type 2.
The HSMs used for Thales Data Protection on Demand are FIPS 140-2 Level 3 certified.
Tenant Administrators have access only to the data that belongs to their account. Tenant specific details and/or metadata are protected at rest using volume encryption.
When the HSM On Demand instance is initialized, the service owner creates passwords or phrases for both the Security Officer and Crypto Officer roles.
Those secrets are used in a derivation scheme and are required to allow the HSM to unseal the cryptographic material.
Only the Security Officer/Crypto Officer are in possession of those secrets. It is left to the discretion of those officers to share the credentials as needed.
Tenant specific details and/or metadata are protected at rest using volume encryption.
Within each PoP, a sophisticated network of routers and firewalls ensures network separation, integrity, and confidentiality of the data and access to that data.
Within the network itself, internal firewalls segregate traffic between the application and database tiers to ensure confidentiality and integrity, as well as deliver a high level of availability.
Physical security underpins any cloud-based service, so all data centers have 24-hour manned security, including foot patrols and perimeter inspections with access controls complying with industry best practices. This may vary based upon the data center but can include proximity, biometric, key, PIN or a combination of any of those controls listed.
The data centers are fully equipped with video surveillance throughout each facility and their perimeters with tracking of asset removal, ensuring that equipment and security of data held within that equipment is assured. The data centers also utilize state of the art technologies ensuring redundancies in connectivity, power, safety and security.
Within the cloud, Thales relies on snapshots to keep copies of storage volumes associated with the application instances.
Snapshots are taken and deleted often. Database backups are managed using relational database backups. Application logs are kept online and securely stored for a determined period of time. Data is kept for a period of time that is related to the relative compliance specific to the region where the data is being stored.
A service wide restoration test is performed annually. For this test, a tape is recalled from off-site storage and the data is restored to a test environment.
Yes. Thales deploys a formal Disaster Recovery plan. The plan is maintained and tested on an annual basis. Any issues identified during the test are formally discussed and remediation plans are put in place. In addition, Thales has a formal Business Continuity plan, which is reviewed annually to determine if updates are required. Procedures to address minor processing errors and outages are documented.