Data and Privacy Policy
Trak will use commercially reasonable efforts consistent with, and no less rigorous than, best industry practices to ensure that appropriate facility and data security procedures and processes are in place to protect against destruction, corruption, loss or alteration of, unauthorized access to, or interference with, any of the customer’s production and other data, accounts, systems, confidential information or customer data created and generated through the use of the Trak software.
Data Storage and Isolation
Trak will not store the customer’s data on unencrypted portable media such as laptop computers, external hard drives, USB drives, or other portable devices. The customer’s data will be properly segregated from all third party data.
Data Access
Access to customer data is restricted to appropriate personnel. The appropriateness is established based on role and the principle of least privilege. Only DBAs, System Engineers and System Administrators may access production application environments containing customer data. Developers, Support personnel and Quality Assurance may require access to non-production environments containing customer data in order to ensure application performance or to troubleshoot a reported customer issue. Support access to troubleshoot data-specific issues is granted explicitly by the customer and provisioned temporarily using automated tools and mechanisms.
Data Transmission
Vulnerability Scans and Testing. Trak will perform regularly scheduled vulnerability assessments on the Trak software. Results from these assessments are internally escalated, planned, prioritized and remediated. Trak will use application and system logging processes, and these logs will be stored, protected and reviewed on a regular basis. Systems will be scanned regularly for vulnerabilities, which will be prioritized and patched according to corporate policy.
Disclosure Requests
If a third party should request that Trak disclose a customer’s data pursuant to a subpoena, summons, search warrant, court or governmental order, Trak will provide the customer with immediate notice and, to the extent permissible by law, a reasonable opportunity to oppose release of the data prior to releasing any such data. If any disclosure is finally directed by a lawful order, Trak will disclose only so much of the data as is necessary to meet the requirements thereof.
Data Location and Redundancy
By default, Trak document storage is provided on Amazon’s Simple Storage Service (S3) platform in US regions. Commitments to encryption, data security, confidentiality and availability are maintained at standards that meet or exceed those established with Trak.
Data Categories
Through The use of the Trak application data may be transferred and stored in order to provide the intended service. The following data categories apply to the types of information transferred and stored by the Trak platform.
Trak performs regular reviews of the security in the Amazon platform. Trak understands the ‘Shared Responsibility Model’ and designs its security controls with these requirements in mind.
Other Services
Document Storage. Trak document storage leverages Amazon’s S3 by default. Providing this functionality on S3 allows customers significant storage scalability. No customer registration is required. Documents are stored in Trak application buckets within Amazon’s S3 platform. Access safeguards are applied to these buckets just as they are for any and all application environments.
Customers remain responsible for the security of the data uploaded to Trak. The data protection is facilitated in a shared responsibility approach between Trak and Amazon. Additional details can be found here. Annually, Trak obtains control requirements for meeting Amazon’s designed control objectives (User Control Considerations) and ensures that appropriate compensating controls are operating effectively in the environment.
Partner Plug-ins and Connectors
Trak may recommend various partner solutions for delivering strategic integrations with independent vendor applications. Safeguards for the tools built and implemented by Trak partner solutions are established and maintained by the partner. Trak does not include these plug-ins and connectors during control performance or application penetration testing. Any additional information related to the security of these partner plug-ins and connectors should be addressed to the partner.
