Unqork Platform Security & Compliance

Security is rooted in everything that Unqork does. Our platform is designed with complex, highly regulated sectors in mind; your expectations for security, privacy, and compliance guide everything we do. Our teams’ decades of collective security, technology, and industry-specific experience have informed the creation of a world-class, security-first SaaS. 

Security incident response

Unqork’s incident response & monitoring program centers on our Security Information and Event Management (SIEM) platform. Logs from the Unqork Platform, our CSPs, and other critical systems are sent to our SIEM, where they are evaluated by a combination of manual analysis, human-generated security policies, and anomaly-detection engines built with advanced machine learning. 

To aid in the investigation of suspicious events, Unqork’s security team leverages a combination of cloud and agent-based intrusion detection/prevention systems (IDS/IPS), as well as a cohort of native cloud tools such as web application firewalls (WAFs) and access analyzers. 

In addition, the Security Team’s incident response plan (IRP) has standardized policy and processes that include training and awareness, incident detection and reporting, containment, eradication, and post-mortem for continuous improvement. The IRP undergoes testing at least once a year, and our Security team works closely with Platform Operations during technology incidents to identify if/when a security nexus exists. Unqork provides 24/7/365 support with severity/priority remediation timeline offerings in line with your risk tolerance.

Security education & training 

Unqork maintains a robust and continuous security training program. All employees are required to complete security awareness training, delivered by a senior member of the Security team, during their first week of employment. After that, employees complete monthly digital training covering a rotating list of topics relevant to Unqork’s business and regulatory obligations. In addition, our Security team delivers annual security and privacy training to all employees, covering a wide range of topics such as new or emerging threats, security processes & procedures, and evolving data privacy laws. Lastly, Unqork provides role-specific security training to individuals with roles and/or responsibilities for specific domains (e.g., incident response, disaster recovery, engineering, etc.) 

Vulnerability management 

We offer a secure and robust platform that is continuously monitored for vulnerabilities and patched to meet the highest security. Continuous scanning includes daily static scans of the platform code and dependencies, weekly dynamic application security tests, and dynamic application security testing prior to your application go-live.

Penetration testing

Unqork regularly assesses its platform security with pentesting annually (at least), including periodic independent network and application pentesting, in-house manual application review and testing, and client-driven application penetration tests.

Unqork makes it easy for organizations to manage and oversee the entirety of the Software Development Lifecycle (SDLC) in one central location, including the Plan, Design, Build, Test, Deploy, and Maintain phases. Unqork applies a security-first approach to each phase.

• Plan
  Regulatory, legal, and security requirements are considered when planning functionality changes to ensure the Unqork platform is able to meet your needs while adhering to all applicable laws and regulations.
• Design
  During the design phase, the proposed changes to the platform’s critical architecture, authentication, authorization, and access control mechanisms are reviewed in-depth. This includes a Security Architecture Review at the application and module level, threat modeling, secure configuration review, and adherence to security best practices. This ensures the Unqork platform is architected securely.
• Build
  Unqork has built a robust build pipeline, which includes revisioning to track changes that are made to an application. The Modules Revision Dashboard provides a fully auditable history of application changes to track who made what changes and when they were made.
• Test
  Prior to promoting changes to production, the platform goes through a series of automated vulnerability assessments and manual penetration tests to ensure architectural and component level modifications don’t expose the underlying platform to security weaknesses and critical vulnerabilities. These include tests from the OWASP Top 10 such as injection attacks. Additionally, secure design requirements stated during the Security Architecture Review are validated against what was built.
• Deploy
  Once an application passes through QA, it’s ready to meet the world—first through deployment into user-acceptance environments and then, when it’s ready, into production. Unqork can help you efficiently organize and manage these crucial processes with in-app Release Management functionality. Unqork’s Release Management Dashboard supports the deployment of applications by enabling Creators to create a release with one or more applications. This functionality is critical because Creators often promote multiple apps together, increasing productivity and reducing the risk of error.
• Maintain
  Because Unqork operates in an agile environment, a waterfall approach is cumbersome and not fit for purpose—making regular security maintenance critical. Similar to the Test phase, automated static code analysis (SAST) is conducted daily across the source code, security composition analysis (SCA) is also conducted to ensure libraries and dependencies are free from defects and mitigating controls are in place when discovered. Dynamic Application Security Testing (DAST) is regularly conducted leveraging an industry-leading application. 

Additionally, weaknesses and vulnerabilities discovered throughout the SDLC process are tracked internally and prioritized for remediation and mitigation activities.

Unqork meets confidentiality, integrity, and availability requirements as well as the strictest information security and privacy standards. Unqork allows organizations to keep all data confidential, fully encrypted at rest and in transit, avoid unauthorized changes, and maintain redundancy for data and service availability.

All your data is securely stored within MongoDB Atlas, our cloud database services provider, ensuring AES256 encryption at rest. All communication and data in transit with and within the cloud network are also secured with TLS 1.2 HTTPS encryption.

All Unqork instances are single-tenant by default. Only your products, rules, and customers live inside of your instance. Every Unqork customer receives several non-production environments in a VPC separate from the production environment.

Unqork uses a defense-in-depth methodology to mitigate any threats that might compromise the confidentiality, availability, or integrity of your data, assets, and services.

Our solutions feature edge-to-edge security capabilities that provide visibility, threat management, and remediation. To handle any security-related incidents, Unqork implements an incident management plan that includes continuous security monitoring and threat detection solutions including web application firewalls, network access control lists (ACLs), native and non-native cloud monitoring tools, and IDS/IPS. 

The Unqork platform allows users to leverage granular RBAC capabilities to manage user access and permissions for each promotable item type and to create separation of duties across required roles.

One of the great benefits of Unqork is how it empowers organizations to seamlessly integrate custom applications with existing legacy systems and external third-party solutions. Whether it be an API, a custom integration, or a blue-chip technology partner, the Unqork platform allows users to authenticate these services through a multitude of methods while providing the means to apply TLS or other controls to further enhance integration security. 

• WORM/system of record
  Unqork eliminates the risk of original records being altered or deleted. You can write immutable information to a single disk one time and prevent editing, overwriting, renaming, or erasing while always maintaining the original submission.
• Data lineage
  Unqork ties submissions to the version of your application or form, with visibility of the data origin, what happens to it, and where it moves over time. See who has changed what, and when, with the ability to trace errors back to the root cause—drop any component into a form and create an audit trail of any interaction on a page.
• Data versioning
  Our platform makes it easy for you to archive individual data iterations, maintain persistent storage of your data, and record and store every submission change made from a record’s creation until the present. You can create full snapshots in real-time and define how long your data is stored and when it will be purged.
• Granular data retention/persistence
  Collect all of your various data, including user session usage and session details. Review at your chosen granularity to visualize & evaluate concurrent data and manage the correlation of summary tables with raw data.

We understand that security is a primary concern for organizations that are evaluating cloud-based applications. Our SaaS operations conform to rigorous certification, compliance, and security programs and processes. We work with AICPA-certified third-party auditors to maintain security compliance with SOC 2 Type II and industry-mandated standards (e.g., HIPAA). SaaS services from Unqork comply with the following important certification and compliance standards:

• SOC2 Type II
  Unqork undergoes annual SOC 2 Type II examinations to attest to those security requirements. This examination is conducted in accordance with AICPA standards, specifically AT-C Section 205. On an annual basis, an external auditor evaluates the design of Unqork’s security controls, to ensure suitable security assurance. Additionally, Unqork’s controls are tested to verify control effectiveness.LEARN MORE
• ISO 27001Unqork is ISO/IEC 27001:2013 certified. ISO 27001 is an internationally recognized standard defining security and privacy best practices for information security management. This certification demonstrates our commitment to preserving the confidentiality, integrity, and availability of information within our security-first SaaS.
• GDPRAs per the definition of the General Data Protection Regulation (GDPR), Unqork processes client data as a Data Processor on behalf of its enterprise clients (the Data Controllers). Our organization and platform respond to—and allow our clients to comply with—privacy regulations such as the GDPR, and the California Consumer Privacy Act (CCPA).LEARN MORE
• HIPAA
  Our team of experienced technology and healthcare industry specialists have designed our platform to manage all electronic protected health information (ePHI) in strict accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), so technology and healthcare companies are able to rapidly transform without sacrificing security. LEARN MORE
• FedRAMP
  We are now live in the FedRAMP Marketplace here. Key to this effort is Unqork’s focus on using proven, authorized services and solutions including, but not limited to:
  • All encryption internal and external uses FIPS validated cryptography suites
  • Use of PIV/CAC authentication for US Government customers
  • Implementation of DNSSEC 
  • Zero-trust architecture
  • Continuous monitoring and third-party audits

When it comes to SaaS, reliability is a cornerstone. In relinquishing control of your software’s backend infrastructure operations, you need a partner that you can trust to ensure the consistent availability and performance of your business-critical applications. 

Unqork provides you with the reliability and availability to give you confidence that your employees and/or customers have access to your Unqork services, when they need it, and from where they need it.

Our always-on monitoring processes and technologies give you peace of mind knowing that your services are constantly being supervised and optimized. 

We’re committed to ensuring that your business-critical software is continuously up and running. SaaS solutions from Unqork operate at near-100% service availability levels² that we have a history of meeting and exceeding. 

We deploy our SaaS solutions in a load-balanced and highly available infrastructure that’s designed to handle heavy traffic and eliminate single points of failure at any level of the deployment architecture. 

Failure detection capabilities exist within each tier, and once activated, send instant alerts to the Network & Security teams for correction. Additionally, failures are automatically contained, as redundant data backups allow single instances to fail without any impact on the service or user experience.

Contingency planning

Our platform is built for high availability with multi-zone redundancy for business continuity and disaster recovery. Customers have complete control and ownership of their data within a single-tenant environment.

Automatic data & configuration backup 

Periodic data backups are performed automatically and allow for one or more data recovery points, giving you the confidence that your data won’t be lost. 

SaaS solutions from Unqork come equipped with built-in data resilience, achieved by automated, scheduled backups of data and configurations that create multiple service recovery points. These are essential to business continuity and disaster recovery plans and, upon a customers’ request, can also be utilized to restore service to a previous state. 

Backup & restoration 

Data backups are separately managed for each of our customers in order to meet the unique requirements of the client’s policies and requirements. The following are some examples of backup and restoration procedures inherent in our SaaS offering: 

• Recurring backupsAll data is routinely backed up and safely stored on a daily basis. Every six hours for transactional data. 
• Retention periodFor most SaaS clients, data backup points are stored for a defined retention period of one calendar year. Clients may define any retention period they may require as short as 24 hours up to multi-year.
• Storage policiesIn case of disaster, additional backup snapshots are stored for use if a recovery effort is required. 

Disaster recovery 

Unqork’s SaaS operations team manages the services necessary to restore your data as soon as possible following a disaster-type event. Our disaster recovery plan is regularly tested and updated to ensure optimal execution in restoring service should a natural or artificial disaster compromise your primary processing location. 

The plan is based on two key metrics: recovery point objective (RPO) and recovery time objective (RTO). The RPO measures the maximum amount of recoverable pre-existing data, prior to the disaster, and the RTO measures the target restoration time of the service following a disaster. 

Achieving these benchmarks is our main goal when facing a disaster recovery situation. Current Unqork RPOs are one hour and RTOs are four hour for each client resulting in best-in-class service.

2 A recent analysis found that Unqork boasted 99.99% uptime in 2020.

The pressures on organizations to “go digital” have never been greater. The Unqork platform takes on much of the “heavy lifting” of enterprise development, so companies can focus entirely on building value-generating applications. This is exactly why we have strived—and continue to strive—to develop a state-of-the-art security program embedded into all aspects of Unqork’s platform. We want our customers to focus on innovation with the knowledge that they are using a platform where security has been a priority from day one.