Security Measures

Apideck implements and maintains Security Measures that meet or exceed the security objectives required for a SOC2 audit. Apideck may update or modify the Security Measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Services. These Security Measures are in effect on the DPA Effective Date. Capitalized terms used herein but not otherwise defined have the meaning given to them in the Data Processing Addendum.

Infrastructure

Apideck Unify, Vault and Proxy are hosted and managed on Amazon Web Services (“AWS”) across multiple availability zones to support fault tolerance, high availability, and disaster recovery. Apideck Ecosystem is hosted and managed on the Vercel Edge Network (”VEN”) which caches content at the edge in order to serve data as fast as possible. Apideck uses AWS for services related to cloud functions, physical and environmental protection, network management, databases, and disk storage supporting the systems.

Apideck products are based on a multi-tenant architecture that applies common and consistent management processes and controls to all customers. The infrastructure has been designed to provide high availability and all critical infrastructure components are redundant across multiple AWS availability zones and/or VEN regions. Cloud functions, servers, and databases are deployed in multiple availability zones each consisting of one or more discrete data centers, with fully redundant power, networking, and connectivity housed in separate secured facilities.

Apideck Unify is built on a no-data-storage principle, which means data coming from the Unified APIs is not stored on Apideck's systems and all API calls are handled in real-time. For Apideck Unify only authentication and logging information is stored.

Network Level Security Monitoring and Protection

Our network security architecture consists of multiple security zones. We monitor and protect our network, to make sure no unauthorized access is performed using:

• A virtual private cloud (VPC), a bastion host or VPN with network access control lists (ACL’s) and no public IP addresses.
• A firewall that monitors and controls incoming and outgoing network traffic.
• An Intrusion Detection and/or Prevention technologies (IDS/IPS) solution that monitors and blocks potential malicious packets.
• IP address filtering
• Distributed Denial of Service (DDoS) mitigation services.

Data Encryption

1. Encryption in transit: All data sent to or from our infrastructure is encrypted in transit via industry best-practices using Transport Layer Security (TLS).
2. Encryption at rest: All our Customer Data is encrypted at rest using the industry-standard AES-256 algorithm.

Application Security Monitoring and Protection

Apideck uses a security monitoring solution to get visibility into application security, identify attacks and respond quickly to a data breach. Technologies to monitor exceptions, logs and detect anomalies in our applications are being used. Apideck collects and stores logs to provide an audit trail of our applications activity.

Apideck uses a runtime protection system that identifies and blocks OWASP Top 10 and business logic attacks in real-time. Additionally, security headers are used to protect our users from attacks. Security automation capabilities that automatically detect and respond to threats targeting our apps are being used.

Business Continuity

Apideck replicates data across multiple systems to help protect against accidental destruction or loss. Apideck has designed and regularly plans and tests its business continuity planning and disaster recovery programs.

Secure Development

Apideck follows security best practices and frameworks (OWASP Top 10, SANS Top 25) for software development. These include but are not limited to:

• Developers participating in regular security training to learn about common vulnerabilities and threats
• Code reviews for security vulnerabilities
• Regularly updated dependencies and vulnerability checks
• Static Application Security Testing (SAST) to detect basic security vulnerabilities in the codebase
• Dynamic Application Security Testing (DAST) to scan the applications
• Regularly scheduled third party penetration tests.

Internal Data Access Processes and Policies

Apideck’s internal data access processes and policies are designed to prevent unauthorized persons or systems from getting access to systems used to process personal data. These processes are audited by an independent auditor. Apideck employs a centralized access management system to control access to production systems and servers, and only provides access to a limited number of authorized personnel. SSO and SSH certificates are used to provide secure access mechanisms. Apideck requires the use of unique IDs, strong passwords and two factor authentication. Granting of access is guided by an internal policy. Access to the system is logged to provide an audit trail for accountability.

Personnel Security

Apideck personnel are required to conduct themselves in a manner consistent with the company’s guidelines regarding confidentiality, business ethics, appropriate usage, and professional standards. Apideck conducts appropriate background checks to the extent allowed by applicable law and regulations. Personnel are required to execute a confidentiality agreement and must acknowledge receipt of, and compliance with, Apideck’s confidentiality, privacy and acceptable use policies. All personnel are provided with security training upon employment and then regularly afterwards. Apideck’s personnel will not process Customer Data without authorization.

Security Certifications and Reports

Service Organization Control (SOC) Reports. Currently, Apideck’s information security control environment applicable to the Services undergoes an independent evaluation in the form of a SOC2 audit. To demonstrate compliance with the Security Measures, Apideck will make available for review by Customer Apideck’s most recent SOC 2 Report as described below.

“SOC 2 Report” means a confidential Service Organization Control (SOC) 2 report on Apideck’s systems examining logical security controls, physical security controls, and system availability, as produced by Apideck’s independent third-party auditor in relation to the Services.