Frequently Asked Security Questions for Symphia NowForce
Data Collection and Retention
Q: Is Symphia NowForce ISO certified?
A: Yes. Symphia NowForce has a ISO 27001 certificate, you can view the certificate here.
Q: Is Symphia NowForce GDPR compliant?
A: Symphia NowForce adheres to GDPR guidelines including data privacy measures, user privacy rights and access rights to the system, but does not have an official GDPR compliance certificate.
Q: Where is Symphia NowForce SaaS client data stored?
A: Client data is stored in three locations: MS SQL data is stored on AWS; Mongo data is stored on Atlas and raw data is stored on AWS S3.
Q: How are Symphia NowForce's WebAPI logs monitored?
A: AWS CloudWatch is used for logging and monitoring of WebAPI logs.
Security Controls
Q: Does Symphia NowForce utilize validation on XML and XSL imports, or make use of a white list input?
A: We use WAF with XSS policies to prevent malicious XML inputs; in addition, the Symphia NowForce API utilizes XML and with an enforced white list input.
Q. How is Symphia NowForce protected against SQL Inject attacks?
A: We use WAF with relevant policies and use Veracode to scan our code for threats.
Q: What measures are in place to prevent cross-site scripting (XSS) attacks?
A: Symphia NowForce makes use of WAF with relevant up to date policies. In addition, an external company runs annual penetration tests including testing for XSS vulnerabilities.
Application Security
Q: What security analysis is run during development of Symphia NowForce products?
A: We use Veracode to run Penetration Static Code Analysis during the development process of every version of our product.
Q Are the outcomes of routine penetration tests and vulnerability scans documented?
A: Yes, reports of testing is managed internally, and can be requested from the Customer Success team.
Q:Does Symphia NowForce use any RFC (RFC6749, RFC6750, etc) for authentication?
A: Yes, RFC 6749 is the core OAuth 2.0 framework which is used by NowForce for authentication.
Access Control
Q: What user authentication measures are used by the Symphia NowForce API?
A:OAuth 2.0 is used.
Q:Are all connection attempts monitored?
A: Yes, these are logged and stored.
Data Control
Q: What encryption is used for secure communication?
A: Data-in-transit encryption uses SSL/TLS 1.2 and data-at-rest encryption is used to encrypt all DB data.
Q: What encryption is used for secure communications between Symphia NowForce and third-parties?
A: We use OAuth 2.0 for authentication, and SSL /TLS 1.2 for all communications between the Symphia NowForce API and third-parties.
Q: Do we utilize data obfuscation for data transfer?
A: No, we make use of TLS as the encryption mechanism for secure communications. The encryption provided by the TLS is more robust than data obfuscation, providing better protection, confidentiality and data integrity.
