Overview
At YotaScale, security, confidentiality, integrity and availability of customer information and systems are our highest priority. We ensure this via a concerted and strategic combination of industry best practices, deep industry experience, and partnership with best-in-class providers such as Amazon Web Services (AWS). As a result, we have put an enormous amount of time and energy into robust security practices and continue to do so.
This document provides a high-level overview of this security posture.
Always encrypted data
Data is encrypted at all times and every step of the way; over the wire and at rest (RSA 2048 and SHA-256) using military grade encryption. All web connections are sent via 256-bit SSL.
We have put strong security measures in place to protect both your identity and access to your data. Strong and secure hash is used to store user passwords and immutable data such as session keys and certain account information. PBKDF2 along with HMAC is used for hash all such data along with a random salt for each user. Your AWS keys are encrypted using AWS 256 and then MAC for maximum security.
Secure AWS Account Access
YotaScale uses roles for cross-account access which is the current best practice for granting access to resources in your AWS account to a trusted principal in a different account (YotaScale). Roles created to grant YotaScale access to your account follow a specific policy that can easily be revoked by you at any time. YotaScale always uses an external ID when assuming the cross-account role, according the AWS best practices.
AWS Partnership
YotaScale is an official solution provider and technology partner for Amazon Web Services.
Secure data centers
YotaScale’s data is stored on AWS data centers that are ISO 27001 certification, PCI DSS Level 1 compliance, and SAS70 Type II. Learn more about AWS security
Strict security and key management procedures
Staff members do not have the ability to decrypt encrypted account data, and we use extensive best practices to keep your sensitive information secure.
If you’d like more detail about our approach to security, we’d be happy to arrange a call with a member of your team. Email support at YotaScale.
YotaScale High Level Architecture
Security Assessments & 3rd Party Audits
YotaScale understands and values the trust our customers place in us. We take security very seriously, and investigate all reported vulnerabilities. We are committed to yearly 3rd party vulnerability scans and mitigate all vulnerabilities found at the highest priority.
YotaScale employs SAMM maturity model internally and enforces strict guidelines to follow security best practices throughout the entire organization. As part of the guidelines we are committed to regular (6 monthly) security audit and 3rd party penetration testing for all our our systems and have regularly passes these tests. Some of the best and most security aware companies are using our services.
We do not share any customer data with 3rd party or vendors.
If you would like to report a vulnerability, you may do so by submitting a report to security@yotascale.com including a demonstrable example of the vulnerability.