Table of Contents
- Vulnerability Disclosure
- Compliance and Certification
- Infrastructure and Network Security
- Business Continuity and Disaster Recovery
- Data Flow
- Data Security and Privacy
- Application Security
- Corporate Security
Security & Compliance
Security and compliance are top priorities for Resolute.AI because they are fundamental to your experience with the product. Resolute.AI is committed to securing your application’s data, eliminating systems vulnerability, and ensuring continuity of access.
Resolute.AI uses a variety of industry-standard technologies and services to secure your data from unauthorized access, disclosure, use, and loss. All Resolute.AI employees are trained on security practices during company onboarding and on an annual basis.
Security is directed by Resolute.AI’s Chief Technology Officer and maintained by Resolute.AI’s Operations team.
If you would like to report a vulnerability or have any security concerns with a Resolute.AI product, please contact firstname.lastname@example.org.
Include a proof of concept, a list of tools used (including versions), and the output of the tools. We take all disclosures very seriously. Once disclosures are receivied, we rapidly verify each vulnerability before taking the necessary steps to fix it. Once verified, we periodically send status updates as problems are fixed.
Compliance and Certification
If you are dealing with any European Union data through a vendor (like Resolute.AI), then you need a contractual agreement in place with each vendor so the EU knows you’re only doing business with companies that fully comply with the General Data Protection Regulation (GDPR). Resolute.AI’s Data Processing Addendum (DPA) form that you can fill out to make your organization automatically GDPR-compliant with Resolute.AI.
Whether you are a Resolute.AI user or not, you can request a copy of the DPA by emailing email@example.com. Complete it by:
- Reviewing and accepting the DPA itself
- Adding your designated EU Representative’s info
- Adding your designated Data Protection Officer’s information
- Double-checking your company details (specifically, the legal name of your business)
In an effort to exceed the requirements of GDPR and provide the same privacy benefits to all our users, Resolute.AI applies the standards of the regulation globally, instead of limiting its scope to Europe. All customer data (and all our marketing data) is treated in a way that conforms with GDPR.
You may submit a GDPR data request to Resolute.AI at any time by emailing firstname.lastname@example.org.
You may also update your consent to be contacted for marketing purposes by emailing email@example.com or via your account privacy settings if you are a Resolute.AI user.
HIPAA and HITECH
Resolute.AI data is hosted on Amazon Web Services, and encrypts all data at rest by default, in compliance with the Privacy Rule within HIPAA Title II. Resolute.AI also exercises strong access control and technical and administrative safeguards in compliance with HIPAA’s Security Rule.
Resolute.AI can sign a Business Associate Agreement (BAA) with Enterprise customers who require data services to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA), amended by the Health Information Technology for Economic and Clinical Health Act (HITECH).
Resolute.AI’s payment and card information is handled by Spreedly and Stripe, which have been audited by independent PCI Qualified Security Assessors and are certified as PCI Level 1 Service Providers, the most stringent level of certification available in the payments industry.
A copy of Resolute.AI's PCI DSS SAQ forms demonstrating PCI compliance can be requested by emailing firstname.lastname@example.org.
Infrastructure and Network Security
Physical Access Control
Resolute.AI is hosted on Amazon Web Services. Amazon data centers feature a layered security model, including extensive safeguards such as:
- Custom-designed electronic access cards
- Vehicle access barriers
- Perimeter fencing
- Metal detectors
Resolute.AI employees do not have physical access to Amazon data centers, servers, network equipment, or storage.
Logical Access Control
Resolute.AI is the assigned administrator of its infrastructure on Amazon Web Services, and only designated authorized Resolute.AI operations team members have access to configure the infrastructure on an as-needed basis behind a two-factor authenticated virtual private network. Specific private keys are required for individual servers, and keys are stored in a secure and encrypted location.
Amazon Web Services undergoes various third-party independent audits on a regular basis and can provide verification of compliance controls for its data centers, infrastructure, and operations. This includes, but is not limited, to SSAE 16-compliant SOC 2 certification and ISO 27001 certification.
Intrustion Detection and Prevention
Unusual network patterns or suspicious behavior are among Resolute.AI’s biggest concerns for infrastructure hosting and management. Amazon Web Services’ intrusion detection and prevention systems (IDS/IPS) rely on both signature-based security and algorithm-based security to identify traffic patterns that are similar to known attack methods.
IDS/IPS involves tightly controlling the size and make-up of the attack surface, employing intelligent detection controls at data entry points, and developing and deploying technologies that automatically remedy dangerous situations, as well as preventing known threats from accessing the system in the first place.
Resolute.AI does not provide direct access to security event forensics, but does provide access to the engineering and customer support teams during and after any unscheduled downtime.
Business Continuity and Disaster Recovery
Every part of the Resolute.AI service uses properly-provisioned, redundant servers (e.g., multiple load balancers, web servers, replica databases) in the case of failure. As part of regular maintenance, servers are taken out of operation without impacting availability.
Resolute.AI keeps hourly encrypted backups of data in multiple regions on Amazon Web Services. While never expected, in the case of production data loss (i.e., primary data stores lost), we will restore organizational data from these backups.
In the event of a region-wide outage, Resolute.AI will bring up a duplicate environment in a different Amazon Web Services region. The Resolute.AI operations team has extensive experience performing full region migrations.
Data into System
API and web clients securely send records to the Resolute.AI server, which processes and stores them for later retrieval or analysis. Audit data of processing and storing is transmitted to our in-house logging infrastructure through encrypted connections.
Data through System
Data is sent securely to Resolute.AI via TLS to an HTTPS endpoint. All data is AES-256bit encrypted, both in transit and at rest. Resolute.AI enriches records using user-configurable machine learning models for later retrieval and analysis.
Resolute.AI’s latest SSL Labs Report can be found here.
Data out of System
Once the record is processed, it can then be accessed via Resolute.AI’s user interface and REST APIs. Resolute.AI integrates with a variety of third-party tools so developers can combine records and analyses from Resolute.AI with data from other systems and manage workflows efficiently. Therefore, Resolute.AI’s high standards for security and compliance also extend to its partner network.
Data Security and Privacy
All data in Resolute.AI servers is automatically encrypted at rest. Amazon Web Services stores and manages data cryptography keys in its redundant and globally distributed Key Management Service. So, if an intruder were ever able to access any of the physical storage devices, the Resolute.AI data contained therein would still be impossible to decrypt without the keys, rendering the information a useless jumble of random characters.
Encryption at rest also enables continuity measures like backup and infrastructure management without compromising data security and privacy.
Resolute.AI exclusively sends data over HTTPS transport layer security (TLS) encrypted connections for additional security as data transits to and from the application.
Resolute.AI retains record data for the lifetime of the customer service agreement.
All customer data stored on Resolute.AI servers is eradicated upon a customer’s termination of service and deletion of account after a 24-hour waiting period to prevent accidental cancellation. Data can also be deleted upon request and via Resolute.AI’s REST API and UI.
Users have the ability to remove individual records or bulk delete.
In addition to password login, two-factor authentication (2FA) provides an added layer of security to Resolute.AI via a time-based one-time password algorithm (TOTP). We encourage 2FA as an important step towards securing data access from intruders. Resolute.AI users can deploy universal second factor devices like YubiKeys (which can also be used to confirm the sudo prompt), TOTP apps like Google Authenticator, or SMS as second factors. This also applies to sign-in with an SSO provider.
Resolute.AI’s organization list also displays who has 2FA enabled so users can vet their own organization’s security.
Resolute.AI’s single sign-on (SSO) implementation prioritizes security. We aggressively monitor linked accounts and will disable them with any reasonable sign that the account’s access has been revoked. SSO also improves user experience by streamlining login and improving access from trusted domains. Resolute.AI currently offers SSO via Google Apps for Work and GitHub Organizations.
In order to facilitate user authentication through the web browser and improve identity management, Resolute.AI offers assertion markup language (SAML)-based SSO as a standard feature to customers on its Enterprise plan. SAML 2.0 enhances user-based security and streamlines signup and login from trusted portals to enhance user experience, access management, and auditability.
Resolute.AI integrates with SAML 2.0 providers including OneLogin, Auth0, and Okta.
REST API Authentication
Resolute.AI’s REST API uses personal auth tokens for authentication. Authentication tokens are passed using the auth header and are used to authenticate a user account with the API.
The Resolute.AI service includes email notifications and reports. Sender policy framework (SPF) is a system to prevent email address spoofing and minimize inbound spam. We have SPF records set through Amazon Web Services, our domain name service (DNS). Resolute.AI users can see the TXT record on resolute.ai:
$ dig resolute.ai TXT +short "v=spf1 include:_spf.google.com include:spf.mandrillapp.com include:aspmx.pardot.com ip4:126.96.36.199 ~all"
We know user administration is central to security and management, and auditing user logs is often the first step in both an emergency response plan and policy compliance requirements. All Resolute.AI customers get admin controls governing identity, access, and usage to keep your data safe, secure, and centrally managed.
Membership within Resolute.AI is handled at the organization level. Each Resolute.AI user should have their own account and can choose their own personal preferences and notifications settings. Access to organizations is dictated by role:
For any organization on a Resolute.AI plan, the project administration portal is the hub for seeing and managing users and usage. The member list includes the username, email, status, added date, teams, and role for each user. The admin or owner can revoke access by project, team, or org and change user role. Additionally, the admin can request login and password history and revoke passwords and active sessions for any user via request to Resolute.AI Support.
In the audit log, all of the actions by user and event within the Resolute.AI UI (e.g., member invite) are listed chronologically by time and IP address so you’ll always have a view into your organization’s most recent history.
Secure Application Development (Application Development Lifecycle)
Resolute.AI practices continuous delivery, which means all code changes are committed, tested, shipped, and iterated on in a rapid sequence. A continuous delivery methodology, complemented by pull request, continuous integration (CI), and automated error tracking, significantly decreases the likelihood of a security issue and improves the response time to and the effective eradication of bugs and vulnerabilities.
Resolute.AI follows the risk management procedures outlined in NIST SP 800-30, which include nine steps for risk assessment and seven steps for risk mitigation.
All Resolute.AI product changes must go through code review, CI, and build pipeline to reach production servers. Only designated employees on Resolute.AI’s operations team have secure shell (SSH) access to production servers.
We perform testing and risk management on all systems and applications on a regular and ongoing basis. New methods are developed, reviewed, and deployed to production via pull request and internal review. New risk management practices are documented and shared via staff presentations on lessons learned and best practices.
Resolute.AI performs risk assessments throughout the product lifecycle in accordance with the standards set forth in HIPAA Security Rule, 45 CFR 164.308:
- Before the integration of new system technologies and before changes are made to Resolute.AI physical safeguards
- While making changes to Resolute.AI physical equipment and facilities that introduce new, untested configurations
- Periodically as part of technical and non-technical assessments of the security rule requirements as well as in response to environmental or operational changes affecting security
The Resolute.AI operations team includes service continuity and threat remediation among its top priorities. We keep a contingency plan in case of unforeseen events, including risk management, disaster recovery, and customer communication sub-plans that are tested and updated on an ongoing basis and thoroughly reviewed for gaps and changes at least annually.
Resolute.AI maintains an internal wiki of security policies, which is updated on an ongoing basis and reviewed annually for gaps. An overview of specific security policies is available to Resolute.AI Enterprise customers upon request:
- Information Security
- Risk Management
- Incident Response
- Vulnerability Management
- Policy Management and Maintenance
All new employees receive onboarding and systems training, including environment and permissions setup, formal software development training (if pertinent), security policies review, company policies review, and corporate values and ethics training.
All engineers review security policies as part of onboarding and are encouraged to review and contribute to policies via internal documentation. Any change to policy affecting the product is communicated as a pull request, such that all engineers can review and contribute before internal publication. Major updates are communicated via email to all Resolute.AI employees.
Resolute.AI follows the incident handling and response process recommended by SANS, which includes identifying, containing, eradicating, recovering from, communicating, and documenting security events. Resolute.AI notifies customers of any data breaches as soon as possible via email and phone call, followed by multiple periodic updates throughout each day addressing progress and impact. Resolute.AI Enterprise plans include a dedicated customer success manager who holds responsibility for customer communication, as well as regular check-ins and escalations.