Security & Compliance
Your Data Is Safe With Us
Torii’s applications and services are designed with security in mind. Clear procedures and automated controls ensure your data remains protected while you stay in control.
Questions about our security measures?
Email our dedicated security team at [email protected].
Cloud Data Storage
Torii leverages Amazon Web Services for hosting and compute power. Amazon maintains and demonstrates SSAE-16 SOC 1, 2 and 3, ISO 27001 and FedRAMP/FISMA reports and certifications. Web servers and databases run on servers in secure data centers.
Backups
Encryption
All data stored in the Service is encrypted both in transit and at rest. Database instances, including read replicas and backups, are encrypted using the industry standard AES-256 encryption algorithm. Encryption is enforced via TLS to all data in transit.
Authentication
Torii authenticates all users with a unique ID and password. All Torii user passwords are encrypted and salted using Bcrypt. Access to Torii restricted API resources are always authenticated.
SAML & MFA
Torii supports SAML 2.0 authentication, allowing customers to implement Single Sign-On (SSO) with their own access policies, including whitelisting and multi-factor authentication (MFA). Customers may also integrate user authentication with their own policy store (e.g., Active Directory).
Confidentiality
All Torii employees and contractors sign confidentiality agreements upon commencing work for Torii.
Training Programs
Torii employees and contractors are trained upon hire and no less than annually thereafter regarding confidentiality, data security, and data handling practices.
Role-Based Access Controls
Administrative access to our production environment is limited to a restricted number of individuals. Access to additional individuals is given only in extreme circumstances, for a specific purpose, and is limited in duration. Such access to these additional individuals is given only after the explicit approval of the security team. User access is evaluated on a quarterly basis and revoked upon termination.
Vendor Management Program
Torii reviews the security and privacy practices of potential vendors to ensure their standards meet or exceed our own.
Business Continuity and Disaster Recovery
Torii has implemented business continuity and disaster recovery policies designed to secure your data even in the event of a disaster. We review our policies no less than annually.
Logging and Monitoring
Torii has implemented monitoring across all components in the architecture. Alerts are generated and sent to relevant stakeholders using internal communications platforms based on predefined rules. The notifications are reviewed and processed based on their level of urgency / priority.
Vulnerability Scanning and Penetration Testing
Torii performs at least one penetration test per year, which is conducted by accredited and completely independent information security companies. Vulnerabilities, if found, are addressed as part of our Risk Management Policy.
Endpoint Scanning
All employees and contractor laptops are equipped with software to scan for malicious threats.
Annual Third-Party Audits
Torii undergoes annual independent SOC 2, Type II audits for security, availability, and confidentiality.
SOC 2 Type II
It also means that our software development processes and practices meet required levels of oversight and monitoring, so that we can proactively monitor, identify and address any unusual activity, remediate it with deep contextual insight, and take corrective action, if and when it is needed.
GDPR
We proactively look at and constantly improve processes related to personal data privacy protection in compliance with legal and contractual obligations for GDPR compliance.
If you have a security question please contact our Security Team
Your Privacy Matters to Us
Torii knows data privacy is important. That’s why we design our products and services with your privacy in mind, and why we are committed to providing you with the information you need about how we handle personal data. Questions about our privacy measures that we didn’t address above? Check out the links below, or email us at [email protected].
