Introduction
Security is an essential part of any SaaS offering. In today’s digital world, cyberattack prevention and the protection of sensitive data have never been more paramount. To meet the digital requirements of the modern enterprise, Unqork leverages stringent controls and protocols to deliver a multitiered defense you can trust. We take a robust People, Process, and Technology approach to provide a platform that protects you and your customers.
Unqork’s vigorous security measures are compliant with both commercial and federal industry standards. Our team has decades of collective experience in some of the world’s most complex and demanding sectors such as finance, insurance, government, and healthcare. We understand security and compliance challenges faced by large organizations and are here to help you overcome them.
Enterprise security is at the core of Unqork’s platform—and our organization. Indeed, Unqork hired a security officer before we even hired our first engineer. And since then, our security team and our capabilities continue to expand and evolve. In this guide, we will provide an overview of how we’ve elevated Unqork platform security from top to bottom.
The core of Unqork’s approach to security is in our Shared Security Model, which identifies the responsibilities owned and shared between Unqork, our customers, and our Cloud Service Providers (CSPs).
Unqork provides the tools and guidance necessary to build secure applications on our platform. However, our customers are ultimately responsible for enabling these security features and creating security controls where required, while also considering applicable laws & regulations1. Unqork is responsible for securing the underlying platform that codeless applications are built on (i.e., server patch management, secure software development, and cloud security) and our CSPs are responsible for the physical security of the cloud infrastructure and ensuring high availability. With Unqork, you inherit layers of technology and applied security controls delivered by Unqork and its CSPs, which means you and your team can focus a greater share of your efforts on building and maintaining applications that add value to your organization.
The chart below depicts three critical layers of the Shared Security Model: Cloud (security responsibility falls to the CSP); Platform (Unqork); and Application (customer).
At the application layer, our customers are responsible for enumerating business and security requirements, and for leveraging Unqork configuration accordingly. Much like how Unqork’s own security team reviews and evaluates the configuration of cloud infrastructure, customers are responsible for considering things such as their access model, API authentication mechanisms, and data schemes within Unqork.
The Unqork platform is entirely managed by Unqork, meaning internal Unqork teams are responsible for the development, maintenance, and security of the Unqork platform itself. Focusing on security, this spans the full gambit of Unqork’s internal development life cycle: From product grooming to code development, all the way to cloud monitoring. Our security program is aimed at delivering our platform with the highest levels of security possible, and leveraging a wide range of tools and risk-based security strategies to ensure that you can build enterprise-grade applications right away.
Unqork’s chosen IaaS CSPs such as AWS or Azure are responsible for protecting the infrastructure that runs all of the services offered in a given CSP’s Cloud. This includes controls such as physical access controls within their data centers, monitoring & management of underlying firmware, and personnel security such as background checks and general access controls.
1 When you engage Unqork’s Application Security Services, we provide hands-on expertise in configuring and delivering applications with manual and automated security testing in line with both business and compliance requirements.
Security is rooted in everything that Unqork does. Our platform is designed with complex, highly regulated sectors in mind; your expectations for security, privacy, and compliance guide everything we do. Our teams’ decades of collective security, technology, and industry-specific experience have informed the creation of a world-class, security-first SaaS.
Unqork’s incident response & monitoring program centers on our Security Information and Event Management (SIEM) platform. Logs from the Unqork Platform, our CSPs, and other critical systems are sent to our SIEM, where they are evaluated by a combination of manual analysis, human-generated security policies, and anomaly-detection engines built with advanced machine learning.
To aid in the investigation of suspicious events, Unqork’s security team leverages a combination of cloud and agent-based intrusion detection/prevention systems (IDS/IPS), as well as a cohort of native cloud tools such as web application firewalls (WAFs) and access analyzers.
In addition, the Security Team’s incident response plan (IRP) has standardized policy and processes that include training and awareness, incident detection and reporting, containment, eradication, and post-mortem for continuous improvement. The IRP undergoes testing at least once a year, and our Security team works closely with Platform Operations during technology incidents to identify if/when a security nexus exists. Unqork provides 24/7/365 support with severity/priority remediation timeline offerings in line with your risk tolerance.
Unqork maintains a robust and continuous security training program. All employees are required to complete security awareness training, delivered by a senior member of the Security team, during their first week of employment. After that, employees complete monthly digital training covering a rotating list of topics relevant to Unqork’s business and regulatory obligations. In addition, our Security team delivers annual security and privacy training to all employees, covering a wide range of topics such as new or emerging threats, security processes & procedures, and evolving data privacy laws. Lastly, Unqork provides role-specific security training to individuals with roles and/or responsibilities for specific domains (e.g., incident response, disaster recovery, engineering, etc.)
We offer a secure and robust platform that is continuously monitored for vulnerabilities and patched to meet the highest security. Continuous scanning includes daily static scans of the platform code and dependencies, weekly dynamic application security tests, and dynamic application security testing prior to your application go-live.
Unqork regularly assesses its platform security with pentesting annually (at least), including periodic independent network and application pentesting, in-house manual application review and testing, and client-driven application penetration tests.
Unqork makes it easy for organizations to manage and oversee the entirety of the Software Development Lifecycle (SDLC) in one central location, including the Plan, Design, Build, Test, Deploy, and Maintain phases. Unqork applies a security-first approach to each phase.
Additionally, weaknesses and vulnerabilities discovered throughout the SDLC process are tracked internally and prioritized for remediation and mitigation activities.
Unqork meets confidentiality, integrity, and availability requirements as well as the strictest information security and privacy standards. Unqork allows organizations to keep all data confidential, fully encrypted at rest and in transit, avoid unauthorized changes, and maintain redundancy for data and service availability.
All your data is securely stored within MongoDB Atlas, our cloud database services provider, ensuring AES256 encryption at rest. All communication and data in transit with and within the cloud network are also secured with TLS 1.2 HTTPS encryption.
All Unqork instances are single-tenant by default. Only your products, rules, and customers live inside of your instance. Every Unqork customer receives several non-production environments in a VPC separate from the production environment.
Unqork uses a defense-in-depth methodology to mitigate any threats that might compromise the confidentiality, availability, or integrity of your data, assets, and services.
Our solutions feature edge-to-edge security capabilities that provide visibility, threat management, and remediation. To handle any security-related incidents, Unqork implements an incident management plan that includes continuous security monitoring and threat detection solutions including web application firewalls, network access control lists (ACLs), native and non-native cloud monitoring tools, and IDS/IPS.
The Unqork platform allows users to leverage granular RBAC capabilities to manage user access and permissions for each promotable item type and to create separation of duties across required roles.
One of the great benefits of Unqork is how it empowers organizations to seamlessly integrate custom applications with existing legacy systems and external third-party solutions. Whether it be an API, a custom integration, or a blue-chip technology partner, the Unqork platform allows users to authenticate these services through a multitude of methods while providing the means to apply TLS or other controls to further enhance integration security.
We understand that security is a primary concern for organizations that are evaluating cloud-based applications. Our SaaS operations conform to rigorous certification, compliance, and security programs and processes. We work with AICPA-certified third-party auditors to maintain security compliance with SOC 2 Type II and industry-mandated standards (e.g., HIPAA). SaaS services from Unqork comply with the following important certification and compliance standards:
When it comes to SaaS, reliability is a cornerstone. In relinquishing control of your software’s backend infrastructure operations, you need a partner that you can trust to ensure the consistent availability and performance of your business-critical applications.
Unqork provides you with the reliability and availability to give you confidence that your employees and/or customers have access to your Unqork services, when they need it, and from where they need it.
Our always-on monitoring processes and technologies give you peace of mind knowing that your services are constantly being supervised and optimized.
We’re committed to ensuring that your business-critical software is continuously up and running. SaaS solutions from Unqork operate at near-100% service availability levels2 that we have a history of meeting and exceeding.
We deploy our SaaS solutions in a load-balanced and highly available infrastructure that’s designed to handle heavy traffic and eliminate single points of failure at any level of the deployment architecture.
Failure detection capabilities exist within each tier, and once activated, send instant alerts to the Network & Security teams for correction. Additionally, failures are automatically contained, as redundant data backups allow single instances to fail without any impact on the service or user experience.
Our platform is built for high availability with multi-zone redundancy for business continuity and disaster recovery. Customers have complete control and ownership of their data within a single-tenant environment.
Periodic data backups are performed automatically and allow for one or more data recovery points, giving you the confidence that your data won’t be lost.
SaaS solutions from Unqork come equipped with built-in data resilience, achieved by automated, scheduled backups of data and configurations that create multiple service recovery points. These are essential to business continuity and disaster recovery plans and, upon a customers’ request, can also be utilized to restore service to a previous state.
Data backups are separately managed for each of our customers in order to meet the unique requirements of the client’s policies and requirements. The following are some examples of backup and restoration procedures inherent in our SaaS offering:
Unqork’s SaaS operations team manages the services necessary to restore your data as soon as possible following a disaster-type event. Our disaster recovery plan is regularly tested and updated to ensure optimal execution in restoring service should a natural or artificial disaster compromise your primary processing location.
The plan is based on two key metrics: recovery point objective (RPO) and recovery time objective (RTO). The RPO measures the maximum amount of recoverable pre-existing data, prior to the disaster, and the RTO measures the target restoration time of the service following a disaster.
Achieving these benchmarks is our main goal when facing a disaster recovery situation. Current Unqork RPOs are one hour and RTOs are four hour for each client resulting in best-in-class service.
2 A recent analysis found that Unqork boasted 99.99% uptime in 2020.
The pressures on organizations to “go digital” have never been greater. The Unqork platform takes on much of the “heavy lifting” of enterprise development, so companies can focus entirely on building value-generating applications. This is exactly why we have strived—and continue to strive—to develop a state-of-the-art security program embedded into all aspects of Unqork’s platform. We want our customers to focus on innovation with the knowledge that they are using a platform where security has been a priority from day one.
The Services are operated by Unqork. All feedback, comments, requests for technical support and other communications relating to the Services should be directed to us at:
85 5th Ave, 6th Floor, New York, NY 10003
