Trust Center

Security

The security practices are grouped into 3 different areas:

Secure Product Build

Password Policy: Minimum requirements for passwords used for authentication are enforced for all organizational systems.

System Hardening: Following CIS benchmarks as our standard for protection against security threats and reducing vulnerability to attacks.

Encryption: All data is encrypted at Rest and in transit.

Access Controls: Role-based access through IAM that enforces segregation of duty, two-factor authentication, and audit trails, ensuring secure access to systems based on the need-to-know principle.

DDoS Protection: Protection against Distributed Denial of Service (DDoS) attacks by defending common network-layer attacks through always-on traffic monitoring and real-time mitigation.

Malware: Threat management protection against malware and man-in-the-middle threats.

Security Updates: Runtime software is regularly updated to address newly discovered vulnerabilities.

Data Protection

Code Review: All changes are reviewed by individuals other than the originating code author and by individuals who are knowledgeable in code review techniques and secure coding practices.

Version Control: Source code is managed centrally with version control, and access is restricted based on various teams that are assigned to a specific project. Records are maintained for code changes, code check-ins, and code check-outs.

Quality Assurance: Builds undergo rigorous functionality, performance, stability, and UX tests before deployment to production.

Segregation of Duties: Access to the production resources is restricted to a limited set of users based on their job roles.

High Availability

High Availability: Multiple instances of our services are running to ensure the high availability of our services for our customers.

Data Backup: Backups are taken every day and are available for a minimum of 1 month for restoration.

Incident & Breach Management: Procedures are established for reporting incidents and tracking them for timely communication, investigation, and resolution.

Disaster Recovery: Infrastructure and storage are replicated in different geo-locations to ensure an uninterrupted experience for customers.

List of Subprocessors

iBwave uses third-party subprocessors to provide specific functionality within iBwave’s services. If a customer objects to the addition of a subprocessor, the customer must email . Otherwise, continued use of the Services signifies the customer’s acceptance of new subprocessors. The following subprocessors may access and process personal information of iBwave’s customers: