We host our solution on Amazon Web Services (AWS) in North America.

Our databases are 256-bit AES encrypted using AWS managed keys. Encrypted backups are taken nightly and stored in a separate geographic location.

We store your merchant statements on S3, which has 99.999999999% durability, with your data being stored across multiple Availability Zones at the same time. For more information: https://aws.amazon.com/s3/faqs/

Application containers and databases reside in private subnets, inaccessible from the outside internet. Access is restricted to the application and bastion layers.

We force HTTPS at the endpoint layer, and employ Domain Name Server and Web Application Firewall technology with advanced Distributed Denial of Service mitigation. We further run malware scans every 6 hours, with zero-day exploit prevention.

Even though we do not process process credit cards, we greatly exceed the PCI DSS requirements.

Our staff must comply with Fee Navigator’s acceptable-use policy prior to gaining access to any protected systems or data. This includes using strong passwords, encrypting their device, enabling multi-factor authentication on all applicable systems, undergoing security training appropriate to their role, etc.

We undergo third-party penetration tests yearly, including manual penetration testing on our application as well as internal and external network penetration testing for our infrastructure to identify potential system vulnerabilities.

This ensures any security issues are resolved before they have a chance to arise and that data is properly guarded. Code audits are performed regularly to scan our code base and find and address any security vulnerabilities.