Security at Meetical

01

Certifications

We’re certified Cloud Fortified by Atlassian. This means we are Cloud Security Participant, run continuous reliability checks and furthermore have a fast response time for any issues which may arise (< 24hours).

These assessment is based on the CAIQ-lite assessment and you can also request the full CAIQ-lite questionnaire from us. As part of the Cloud Security program, we use BugCrowd, a bug bounty program, which onboarded over a hundert security engineers to run penetration and security tests for our Apps. Any issues found must be closed by defined SLAs within the program.

For data storage, Atlassian themselves holds a couple of the industry leading certificates including SOC2 and ISO 27001, which we are looking into getting it also for our own systems, as our company grows.

Meetical

Cloud Security Participant

by
‍

+
‍

Atlassian Cloud

02

Data protection and privacy

We protect your data both in transit and at rest with industry standard security. In transit we apply TLS/SSL (SHA-256 with RSA Encryption). At rest, sensitive information is encrypted with AES.* Our privacy policy covers modern principles on how we collect, use, protect or otherwise handle your data.

03

Access management

Any access to our services and apps exclusively relies on industry-standard techniques, based on OAuth and the Implementations of Atlassian, Google or Microsoft. Relying on these secure methodologies for authentication, eliminates many attack vectors from the start.
Internally, our security policy lies a solid ground for security best practices and we closely monitor who has access to which systems. While every employee gets access to knowledge, where things can be found, only senior engineers and trusted members get access to production classified information.

04

Data protection and privacy

From day one, we’ve built our applications in a way to be ready for horizontal scaling, powered by Heroku. While their data services might not be the most economic solution, we profit from high availablity, passwort rotation mechanisms, redundancy, automatic backups, managed updates and much more – for both our apps and data storages. (In the past 18 months, until June ’21, we only registered a single 4hour downtime of our app, caused by a global Heroku data services outage.)

05

Incident Management

Despite all best efforts, no system is 100% secure. Security incidents can occur and we are ready to tackle them down fast. We are an Atlassian shop, no suprise, and as such, we use Jira Service Management to help us track and resolve customer requests as well as any critical security incidents. Furthermore, for any critical security issues we can escalate things quickly to our partnes and collaborate to resolve any issues rapidly.