Security Center
PlusPlus InfoSec Overview
PlusPlus maintains administrative, technical, and physical controls as part of a documented and certified information security program under ISO 27001 and SOC2 Type 2 or similar established industry standards. PlusPlus regularly reviews controls to assess compliance with applicable law and sufficiency in light of the (a) size and nature of PlusPlus business; (b) resources available to PlusPlus; (c) nature of the information that PlusPlus stores; and (d) need for security, confidentiality and privacy for such information.
PlusPlus information security program is governed by PlusPlus Security Council under the leadership of the Information Security Department, which is responsible for overseeing and enforcing security training; physical and environmental security controls; systems access controls; security incident procedures; contingency planning and business continuity; audit controls; data integrity protections; systems testing and monitoring; and procedures for secure data destruction. PlusPlus information security program includes the following sections:
Security Training and Software Coding Standards
PlusPlus employees and contractors participate in annual security awareness training and agree to comply with published security policies. PlusPlus regularly conducts mandatory secure development training for all developers. In addition, PlusPlus has adopted secure coding standards, developed in accordance with the OWASP Top 10 and SANS guidelines, which define the security principles, standards, guidelines, and best practices for secure code development.
Physical and Environmental Security Controls
PlusPlus limits access to PlusPlus facilities to authorized and badged individuals. PlusPlus policies require that visitors are registered, recorded, and accompanied at all times. PlusPlus’ Cloud Application Platform comes with its own Environmental Safeguards, including physical security, fire detection and suppression, power backup, and climate and temperature controls.
Access to PlusPlus systems is further restricted to individuals with a legitimate business need and appropriate approval(s). PlusPlus requires that all access rights be assigned based on the “least privilege” principle and removed when no longer necessary. PlusPlus physical security controls include but are not limited to logging and monitoring unauthorized access attempts to facilities.
Systems Access Controls
PlusPlus limits access to PlusPlus information systems to named and authorized individuals with a legitimate business need and appropriate approval(s). PlusPlus requires a two-factor (also known as, two-step and multi-factor) authentication safeguard for all privileged administration of its platform, systems, or any of the underlying infrastructure. PlusPlus default configuration limits individual customer access to specific customer-approved SSO domains, and PlusPlus recommends to its customers that they use the same default limitations.
Security Incident Procedures
PlusPlus security incident response plan includes procedures to be followed in the event of a security breach of applications or systems that access, process, store, communicate, or transmit customer data. PlusPlus incident response plan includes the following procedures:
- Respond. Assemble the internal incident response team.
- Validate. Qualify the existence of security event(s).
- Scope. Assess impact.
- Contain. Limit impact and potential damage and preserve evidence.
- Report. Determine if regulatory or contractual reporting requirements exist based on the nature of the incident and perform appropriate notifications.
- Recover. Restore normal service and analyze the incident for potential legal action.
- Improve. Perform root cause analysis, determine lessons learned and implement strategic remediation.
PlusPlus provides appropriate communications to affected customers in the event of a security incident compromising such customers’ data.
Contingency Planning and Business Continuity
PlusPlus maintains policies and procedures for responding to emergency situations (e.g., fire, vandalism, system failure, and natural disaster) that could damage or otherwise compromise customer data. Such procedures include, but are not limited to:
- Continuously backing up production file systems and databases.
- Employing a formal business continuity and disaster recovery plan, including:
- Periodic disaster recovery testing for SaaS services.
- Contingency plans for each key business function, including customer support, operations, and administrative functions, to continue critical business and service activities through certain emergency situations
- Crisis communication plans to provide appropriate communications to affected parties.
- Maintaining a formal process to evaluate PlusPlus contingency planning and business continuity policies.
Audit Controls
PlusPlus maintains the hardware, software, and procedural mechanisms to record and examine activity in information systems that contain or use electronic information, including appropriate audit tail logs and reports concerning these security requirements.
These controls are designed to provide deep insights into:
- Modification, addition, or removal of key system components
- Unauthorized modifications of data and configurations
- The breadth of attack impact and the point of source
Data Security Controls
PlusPlus maintains policies and procedures to ensure the confidentiality, integrity, and availability of customer data.
PlusPlus requires that all access rights to customer data be assigned based on the “least privilege” principle and removed when no longer necessary.
Customer data in the PlusPlus cloud is firewalled on a secured, DDoS-protected network; safeguarded by industry-standard SSL/TLS encryption in transit and at rest; and fortified using industry-standard network intrusion detection and/or network intrusion prevention systems. This helps ensure that access to data is always available and that all data is consistent, trustworthy, and accurate.
PlusPlus cloud provider utilizes malware detection systems, which include mathematical threat prediction models intended to help prevent the execution of predicted, novel, or targeted malicious threats.
Testing and Monitoring
PlusPlus regularly tests key controls, systems, and procedures of its information security program to validate that they are properly implemented and effective in addressing the threats and risks identified. Internal audits are conducted on an ongoing basis and independent third-party audits are conducted annually and more frequently as needed, based on the results of periodic risk assessments and continuous monitoring of the threat landscape.
PlusPlus monitors its systems, logs, and events, including by:
- Reviewing changes affecting systems handling authentication, authorization, and auditing.
- Reviewing privileged access to PlusPlus production systems.
- Engaging third parties to perform network vulnerability assessments and penetration testing on a regular basis.
Furthermore, PlusPlus leverages Cloudflare for proactive risk identification, real-time attack blocking, and web application firewalling of all access to its systems.
Secure Destruction
Other than in exceptional circumstances, PlusPlus purges all customer data upon verification that the relevant contract has been validly terminated and the relevant customer data is no longer required.
PlusPlus standards for the secure destruction of data are based upon guidance from NIST Special Publication 800-88, Revision 1 (2014): Guidelines for Media Sanitization or similar industry standards established in the future.
Shared Responsibility
Customer trust and confidence are critical to PlusPlus and its customers’ continued success. Both providers and consumers of SaaS services must understand that security is a shared responsibility. As a SaaS provider, PlusPlus is responsible for the secure delivery of PlusPlus SaaS services, which include the underlying infrastructure required to deliver such services. As a SaaS consumer, the customer is responsible for data provided to PlusPlus and non-PlusPlus services that are integrated with PlusPlus services.
