Information Security
Your data security is our priority
Security Infrastructure
FactorFactory employs enterprise-grade security measures to protect your assessment data:
Heroku Enterprise Cloud Platform
- Built on AWS infrastructure with enterprise-grade security
- 99.99% uptime SLA with redundant infrastructure
- Multi-region data replication and automated failover
- Physically secure data centers with biometric access controls
- 24/7 security monitoring and incident response team
- DDoS protection and web application firewall
Data Encryption
- TLS 1.3 encryption for all data in transit (latest standard)
- AES-256 encryption for data at rest
- Encrypted PostgreSQL database connections
- End-to-end encryption for assessment data
- Secure key management with automated rotation
Database Security
- Heroku Postgres with automated security patches
- Continuous Protection with automated backups every hour
- Point-in-time recovery up to 4 days
- Database encryption at rest and in transit
- Isolated database instances with private networking
Compliance & Certifications
Our platform meets or exceeds requirements for:
- SOC 2 Type II: Annual independent audit of security, availability, and confidentiality controls
- GDPR: EU General Data Protection Regulation - Full compliance with data subject rights
- HIPAA: Health Insurance Portability and Accountability Act - Business Associate Agreement available
- PCI DSS Level 1: Payment Card Industry Data Security Standard - Highest level of compliance
- ISO 27001: Information security management system certification
- CCPA: California Consumer Privacy Act compliance
Access Controls
- Multi-factor authentication available
- Role-based access controls
- Session management and timeouts
- IP-based access restrictions available
- Audit logs of all access
Data Protection
Backup & Recovery
- Automated daily backups
- Geographically distributed backup storage
- Point-in-time recovery capabilities
- Regular disaster recovery testing
Data Isolation
- Logical separation of partner data
- Encrypted data boundaries
- Secure API endpoints
- No shared assessment data
Security Monitoring
- 24/7 security monitoring
- Intrusion detection systems
- Automated threat detection
- Regular vulnerability scanning
- Security incident response team
Best Practices
We recommend partners follow these security practices:
- Use strong, unique passwords
- Enable multi-factor authentication
- Regularly review account access
- Keep contact information updated
- Report suspicious activity immediately
Security Updates
We maintain security through:
- Regular security patches and updates
- Annual third-party security audits
- Continuous security training for staff
- Proactive threat intelligence monitoring
Reporting Security Issues
If you discover a security vulnerability, please report it immediately:
Email: [email protected]
Subject Line: SECURITY ISSUE
We take all security reports seriously and will respond within 24 hours.