Trust & Security

Smoothlink understands that there’s a lot of trust on behalf of our customers to keep their data on the Cloud. Security is a top priority for Smoothlink, and we continue to invest significantly in broad initiatives to ensure that our customers’ data is safe, secure, and private. Smoothlink uses a shared responsibility model which means that while Smoothlink employees perform some administrative tasks, customers manage their accounts, data, projects, and more.

How does Smoothlink design security?

Smoothlink takes steps to protect your information throughout the Software Development Lifecycle and in the design of our architecture and infrastructure. Our Information Security team is consulted at each phase of development, and they are part of code reviews.

Where is customer information stored?

To provide redundancy and reduce latency, Smoothlink uses a robust global network of servers in 5 locations, maintained by DigitalOcean and Amazon Web Services, for file storage. All systems run monitoring tools with automated alerts integrated with an on-call rotation and automatic escalation. Information on which File Storage Profile is being used to house a customer’s data is available in their portal.

• • Data Redundancy means the same piece of information exists in multiple places. Having redundancy helps Smoothlink restore the data in case of corruption or accidental deletion in the event of an incident.
  • Latency refers to the time it takes for data to be transferred between its original source and its destination. By having a worldwide network of servers, customer data can be stored at a site in their designated region.

AWS & DigitalOcean provides enterprise-class tools that have been proven to be both reliable and secure for today’s web-based applications. Amazon’s & DigitalOcean’s cloud computing services are in use at companies of all sizes, from startups to large enterprises. By leveraging the AWS & DigitalOcean network, Smoothlink can offer our customers unlimited data storage on the Smoothlink Platform.

Data Center Security and Compliance: How does Smoothlink’s Cloud Service Provider CSP safeguard data?

Amazon Web Services (AWS) & DigitalOcean are Smoothlink’s Infrastructure as a Service IaaS providers. AWS/DigitalOcean provide Smoothlink and our customers the flexibility to scale as needed, and the knowledge that all data is hosted securely and privately. AWS/DigitalOcean provides the physical security access controls to the physical hardware used to provide the Smoothlink solution. For more information on AWS or DigitalOcean security protocols, please refer to their webpage.

How does Smoothlink monitor its data server provider?

Smoothlink’s relationship with AWS and DigitalOcean are as an Infrastructure as a Service IaaS vendor. They provide the hosting capacity on which we build the Smoothlink SaaS platform. AWS/DigitalOcean is not engaged in a consulting or product-specific capacity. They have no responsibilities or duties which are derived from the specific nature of our software or our customers. The access granted to Infrastructure Partners is managed via technical controls based on the policy of least privilege: “Access to Information: The provider must be given the least amount of network, system, and/or data access required to perform the contracted services. This access must follow applicable policies and be periodically audited.”

Smoothlink Access and Information Sharing

Smoothlink takes steps to ensure the right people have access to the right information and the wrong people don’t. We built in tools and control mechanisms at multiple levels to help you collaborate and securely share information to the extent you decide.

How does Smoothlink handle access for users?

During the implementation process, company-wide settings are applied for access levels and security settings. These are called role-based access controls RBAC. Administrators then execute these controls on an ongoing basis. For subsequent configuration changes, people with the appropriate permissions submit requests.

Smoothlink provides options for role-based permissions for web and mobile applications. Among the security setting selections are: 2 factor authentication, lockout after failed sign-in attempts, password expiration, and idle session timeouts. Company administrators can unlock accounts.

Which teams at Smoothlink can access my information?

Smoothlink’s Access Control Policy adheres to the principle of least privilege, where employees, contractors, and all third-party vendors will be provided the least amount of access required to perform their job functions. Management is committed to testing and monitoring programs designed to ascertain whether the systems of controls and their component parts are functioning as intended and whether they afford an acceptable level of protection as time and technology advance. At a minimum, management will review access granting and control effectiveness on a semi-annual basis. Direct access to client data is limited to legitimate business needs, including activities required to support clients’ use of the Smoothlink SaaS applications. Employees may only access resources relevant to their work duties.

Network Security Management

Smoothlink takes network security very seriously to ensure that customer data is transferred to and from the production system securely. Smoothlink manages this through network observability, web application firewalls, hardened server configurations, patching, strong encryption, and DDoS protection.

How are Smoothlink’s firewalls configured?

Following the principle of network segmentation, Smoothlink only allows necessary communication for valid business purposes. System firewalls, network security groups and advanced WAF technology are employed to protect Smoothlink assets. All system firewall rules are managed by configuration software and all changes are reviewed before deployment.

How does Smoothlink protect against distributed denial of service DDoS attacks?

Smoothlink utilizes DDoS mitigation services from their hosting provider to protect all Smoothlink production networks. These are robust cloud-based solutions encompassing real-time traffic modeling right down to server-level anomaly detection and attack mitigation and includes three layers of protection to identify and filter hostile traffic 24 7 365 to ensure customer uptime in the event of a DDoS.

How does Smoothlink monitor for technical vulnerability and viruses?

Smoothlink subscribes to manufacturer and independent security notification services to monitor potential external threats. Smoothlink uses automated tools and documented procedures to build and configure all network equipment, systems, and servers from approved playbooks. Systems, platforms, and applications are configured to minimize security risks.

Leveraging state-of-the-art CSPM and Vulnerability Management tools, Smoothlink continuously monitors all environments for vulnerabilities and risky misconfigurations. Our Vulnerability Management Program VMP handles identified vulnerabilities and misconfigurations. System patches are measured against documented Service Level Objectives SLOs).

Smoothlink has established a standard Incident Response Plan that is used for any application level or security incident. This is based on industry best practices and is reviewed regularly.

How does Smoothlink secure applications?

Smoothlink customers access the Smoothlink environment via the public Internet. Transport Layer Security TLS is an encryption technology that Smoothlink utilizes to protect clients’ private information while it is in transit via the Internet.

To protect all data stored by our customers on the Smoothlink Platform, Smoothlink encrypts that data while stored at our data center providers. Data at Rest DAR For DAR Smoothlink utilizes provider-managed device encryption services.

Data in Transit: Smoothlink connections are secured using HTTPS protected by Transport Layer Security TLS. The data in transit is encrypted using the AES256 standard, the secure hash algorithm SHA2 for message authentication, and RSA as the encryption key exchange mechanism.

All services use one of the strongest block ciphers available, 256-bit Advanced Encryption Standard AES256, to encrypt your data. The provider-managed encryption services provide that the keys are securely managed.