Security
Protecting your information is our highest priority.
We use Effortless Admin every day to administer the employee benefits of thousands of Canadian employees. Ensuring our platform remains secure and protecting your information is our highest priority. Our goal is to provide you with a secure environment, while being mindful of application performance and overall user experience.
SOC 2 Type II
Independently audited. Operating effectively. Every year.
Our policies, insurance coverage, and controls are published at the Trust Centre. Invite-only. We grant access to our clients and partners.
Our security strategy covers all aspects of our business
-
Physical and environmental security
-
Operational security processes
-
Scalability and reliability of our platform architecture
-
Systems development and maintenance
-
Corporate security policies and procedures
Confidentiality
We place strict controls over our employees' access to your data. We are committed to ensuring that Customer Data is not seen by anyone who should not have access to it. The operation of our services requires that some employees have access to the systems that store and process Customer Data. For example, in order to diagnose a problem you are having with the Effortless Admin services, we may need to access your Customer Data. These employees are prohibited from using these permissions to view Customer Data unless it is necessary to do so.
Personnel practices
Effortless Admin conducts background checks on all employees before employment, and employees receive regular privacy and security training. All employees are required to read and sign our comprehensive information security policy covering the security, availability, and confidentiality of the Effortless Admin services.
Incident management and response
In the event of a security breach, Effortless Admin will promptly notify you of any unauthorized access to your Customer Data. Effortless Admin has incident management policies and procedures in place to handle such an event.
Security in our software development lifecycle
Effortless Admin uses the git revision control system. Changes to Effortless Admin's code base:
- Go through a suite of automated tests
- Go through a round of manual tests
- Are manually reviewed and tested by a senior developer
When code changes pass our acceptance process, the changes are first pushed to a staging server wherein Effortless Admin employees are able to perform a final round of tests before pushing the change to our production servers and our customer base. Effortless Admin developers also have the ability to "cherry pick" critical updates and push them immediately to production servers.
Security at the Effortless Admin office
We monitor the availability of our office network and the devices on it. We collect logs produced by networking devices such as firewalls, DNS servers, DHCP servers, and routers in a central place. The network logs are retained for the security appliance (firewall), wireless access points, and switches.
Architecture and scalability
Scalability and reliability of architecture
Effortless Admin uses Microsoft Azure to manage platform data. The architecture of the database has been designed with built in redundancy to seamlessly withstand hardware failure. As an extra precaution, we take hourly snapshots of the database and securely move them to a physically separate server so that we can restore them elsewhere as needed.
We currently host data in secure, compliance-audited data centers via Microsoft Azure in Canada.
Encrypted transactions
Web connections to the Effortless Admin service are via TLS 1.2 and above. We support forward secrecy and AES-CBC, and prohibit insecure connections using TLS 1.1 and below or RC4.
Information security
All laptops and workstations are secured via full disk encryption and centrally managed. We diligently apply updates to employee machines and monitor employee workstations for malware. We also have the ability to apply critical patches and remote wipe a machine.
Data centre security
Microsoft Azure employs a robust physical security program with multiple certifications, including SOC 1, 2, 3 (SSAE 16) and other certifications. For more information on Microsoft Azure's physical security processes, please visit the Microsoft Trust Center.
Policies and agreements
Availability
We are committed to making Effortless Admin consistently available to you and your company. Our systems have built-in redundancy to withstand failures and are constantly monitored to keep your work uninterrupted. You can always monitor our availability at our platform status page.
Questions regarding our security?
We would be happy to answer them. Email us at privacy@effortlessadmin.com.