Last Revised
June 12, 2022
Introduction
Due to the sensitive data processed in our software, Planhat has implemented processes to maintain security of customer and user data processed.
Planhat is SOC 2 certified. Should you require a copy of the SOC 2 report, or if you have any other security or compliance related questions, please contact compliance@planhat.com.
Below, we have summarized key security processes at Planhat.
Security Process Summary
1. Production Environment
Planhat employs a cloud deployment model for its software-as-a-service (“SaaS”) solution. All software maintenance and configuration activities are conducted by Planhat employees. The same databases are never used to store data from different clients (tenants), which is the safest and most robust approach for a multi-tenant enterprise solution. Planhat employs industry standard practices for security controls such as firewalls, intrusion detection, and change management.
2. Scalability
Planhat distributed architecture for data collection and processing allows it to scale horizontally as the number of clients and volume of traffic increase. Planhat uses multiple monitoring processes and tools to continuously track network resources, operating systems, applications and capacity. Systems are scaled up when predetermined capacity thresholds are reached.
3. Risk Management
Planhat has practices in place as part of its business continuity planning to assist management in identifying and managing risks that could affect the organization’s ability to provide reliable services to its clients (as further described in Section 12 below). These practices are used to identify significant risks for the organization, initiate the identification and/or implementation of appropriate risk mitigation measures, and assist management in monitoring risk and remediation activities.
4. Policies
Planhat maintains, and annually updates, a general written Information Security Policy, which details employee’s responsibilities toward confidentiality of client data and acceptable use of resources. All staff must review and acknowledge policy.
5. Segregation of Duties
Only authorized personnel can administer systems or perform security management and operational functions. Authorization for and implementation of changes are segregated responsibilities wherever appropriate to the organization. Access to client data is restricted to legitimate business use only.
6. Employee Screening
Planhat employees are required to undergo background checks and provide specific documents verifying identity at the time of employment.
7. Terms of Employment
General information security responsibilities are documented in Planhat Information Security Policy, which all employees must sign as part of their onboarding.
8. Training
General information security training is provided to all new employees (both full time and temporary) as part of their onboarding. A compulsory annual security and privacy training requirement ensures employees refresh their knowledge and understanding. Additional security training is also provided to employees who handle client data.
9. Termination of Employment
Planhat manages a formal termination process, which includes removal of any potential access to Planhat and related data. The exit interview reminds ex-employees of their remaining employment restriction and contractual obligations.
10. Documentation and Change Management
All critical and repeatable processes and security checks in Planhat production environment are either documented in procedures or implemented as automation scripts. Planhat maintains and follows formal change management processes. All changes to the production environment (network, systems, platform, application, configuration, including physical changes such as equipment moves) are tracked and documented. All relevant business owners such as Support, Engineering, and DevOps, Security are represented at regular change management meetings.
11. Environments
Both scheduled and emergency changes are tested in separate environments, reviewed and approved by Engineering, and Technical Support before deployment to the production environment. Testing, other than deployment validation, is prohibited in the production environment.
12. Backup
Planhat stores all client data in fully redundant databases. Daily and intraday data is backed up on a scheduled basis, encrypted using Advanced Encryption Standard (AES) algorithm, AES-256, and stored in a geographically separated location.
13. Logging and Monitoring
Planhat uses an industry standard enterprise application management solution to monitor systems 24×7, trigger alerts based on event logs, and to facilitate alerting, trend analysis, and risk assessment.
14. Encryption
Any customer data in the Planhat application is encrypted in transit over public networks using Transport Layer Security encryption (TLS / HTTPS). The data provided by Planhats clients within the Planhat application is stored using industry-standard AES-256 encryption at rest.
15. Development and Support Process
Planhat follows an agile development methodology in which products are deployed on an iterative, rapid release cycle. Security and security testing are implemented throughout the entire software development methodology. Quality Assurance is involved at each phase of the lifecycle and security best practices are a mandated aspect of all development activities.
16. Incident Process
Planhat has developed a robust Security Incident Response Process (“SIRP”) to address events in an efficient and timely manner. The SIRP framework describes how the team is deployed, documents the criteria for incident severity, defines the investigation and diagnosis workflow, details documentation and reporting requirements, and establishes contact information. Security incidents are escalated from the initial responders to the relevant Account Manager for client notification. All critical issues confirmed are remediated immediately. Issues of lesser severity are evaluated for resolution as part of the standard development process.
17. Business Continuity and Disaster Recovery
Business continuity planning (BCP) and disaster recovery (DR) activities prioritize critical functions supporting the delivery of Planhats SaaS Solutions to its clients. The development and scope of BCP and DR in each business function reflects the criticality of each function and/or facility in order to maximize the effectiveness of these efforts.
18. Redundancy
Planhat SaaS Solutions architecture utilizes redundancy through the entire infrastructure, from load balancers, storage units and processing engines, to power and telecommunication providers. No system or device has a single point of failure. Data is always written to two separate locations when stored.
