Trust & Security

Smoothx understands that our customers have a lot of trust on behalf of our customers to keep their data on the Cloud. Security is a top priority for Smoothx, and we continue to invest significantly in broad initiatives to ensure that our customers’ data is safe, secure, and private. Smoothx uses a shared responsibility model, which means that while Smoothx employees perform some administrative tasks, customers manage their accounts, data, projects, and more.

How does Smoothx design security?

Smoothx takes steps to protect your information throughout the Software Development Lifecycle and in the design of our architecture and infrastructure. Our Information Security team is consulted at each phase of development, and they are part of code reviews.

Where is customer information stored?

To provide redundancy and reduce latency, Smoothx uses a robust global network of servers in 5 locations, maintained by DigitalOcean and Amazon Web Services, for file storage. All systems run monitoring tools with automated alerts integrated with an on-call rotation and automatic escalation. Information on which File Storage Profile is being used to house a customer’s data is available in their portal.

• • Data Redundancy means the same piece of information exists in multiple places. Having redundancy helps Smoothx restore the data in case of corruption or accidental deletion in the event of an incident.
  • Latency refers to the time it takes for data to be transferred between its original source and its destination. By having a worldwide network of servers, customer data can be stored at a site in their designated region.

AWS & DigitalOcean provide enterprise-class tools that have been proven to be both reliable and secure for today’s web-based applications. Amazon’s & DigitalOcean’s cloud computing services are in use at companies of all sizes, from startups to large enterprises. By leveraging the AWS & DigitalOcean network, Smoothx can offer our customers unlimited data storage on the Smoothx Platform.

Data Center Security and Compliance: How does Smoothx’s Cloud Service Provider CSP safeguard data?

Amazon Web Services (AWS) & DigitalOcean are Smoothx’s Infrastructure as a Service IaaS providers. AWS/DigitalOcean provide Smoothx and our customers the flexibility to scale as needed and the knowledge that all data is hosted securely and privately. AWS/DigitalOcean provides the physical security access controls to the physical hardware used to provide the Smoothx solution. For more information on AWS or DigitalOcean security protocols, please refer to their webpage.

How does Smoothx monitor its data server provider?

Smoothx’s relationship with AWS and DigitalOcean are as an Infrastructure as a Service IaaS vendor. They provide the hosting capacity on which we build the Smoothx SaaS platform. AWS/DigitalOcean is not engaged in a consulting or product-specific capacity. They have no responsibilities or duties that are derived from the specific nature of our software or our customers. The access granted to Infrastructure Partners is managed via technical controls based on the policy of least privilege: “Access to Information: The provider must be given the least amount of network, system, and/or data access required to perform the contracted services. This access must follow applicable policies and be periodically audited.”

Smoothx Access and Information Sharing

Smoothx takes steps to ensure the right people have access to the right information and the wrong people don’t. We built in tools and control mechanisms at multiple levels to help you collaborate and securely share information to the extent you decide.

How does Smoothx handle access for users?

During the implementation process, company-wide settings are applied for access levels and security settings. These are called role-based access controls RBAC. Administrators then execute these controls on an ongoing basis. For subsequent configuration changes, people with the appropriate permissions submit requests.

Smoothx provides options for role-based permissions for web and mobile applications. Among the security setting selections are: 2 factor authentication, lockout after failed sign-in attempts, password expiration, and idle session timeouts. Company administrators can unlock accounts.

Which teams at Smoothx can access my information?

Smoothx’s Access Control Policy adheres to the principle of least privilege, where employees, contractors, and all third-party vendors will be provided the least amount of access required to perform their job functions. Management is committed to testing and monitoring programs designed to ascertain whether the systems of controls and their component parts are functioning as intended and whether they afford an acceptable level of protection as time and technology advance. At a minimum, management will review access granting and control effectiveness on a semi-annual basis. Direct access to client data is limited to legitimate business needs, including activities required to support clients’ use of the Smoothx SaaS applications. Employees may only access resources relevant to their work duties.

Network Security Management

Smoothx takes network security very seriously to ensure that customer data is transferred to and from the production system securely. Smoothx manages this through network observability, web application firewalls, hardened server configurations, patching, strong encryption, and DDoS protection.

How are Smoothx’s firewalls configured?

Following the principle of network segmentation, Smoothx only allows necessary communication for valid business purposes. System firewalls, network security groups and advanced WAF technology are employed to protect Smoothx assets. All system firewall rules are managed by configuration software, and all changes are reviewed before deployment.

How does Smoothx protect against distributed denial of service DDoS attacks?

Smoothx utilizes DDoS mitigation services from its hosting provider to protect all Smoothx production networks. These are robust cloud-based solutions encompassing real-time traffic modeling right down to server-level anomaly detection and attack mitigation and include three layers of protection to identify and filter hostile traffic 24 7 365 to ensure customer uptime in the event of a DDoS.

How does Smoothx monitor for technical vulnerability and viruses?

Smoothx subscribes to manufacturer and independent security notification services to monitor potential external threats. Smoothx uses automated tools and documented procedures to build and configure all network equipment, systems, and servers from approved playbooks. Systems, platforms, and applications are configured to minimize security risks.

Leveraging state-of-the-art CSPM and Vulnerability Management tools, Smoothx continuously monitors all environments for vulnerabilities and risky misconfigurations. Our Vulnerability Management Program VMP handles identified vulnerabilities and misconfigurations. System patches are measured against documented Service Level Objectives SLOs).

Smoothx has established a standard Incident Response Plan that is used for any application level or security incident. This is based on industry best practices and is reviewed regularly.

How does Smoothx secure applications?

Smoothx customers access the Smoothx environment via the public Internet. Transport Layer Security TLS is an encryption technology that Smoothx utilizes to protect clients’ private information while it is in transit via the Internet.

To protect all data stored by our customers on the Smoothx Platform, Smoothx encrypts that data while stored at our data center providers. Data at Rest DAR For DAR Smoothx utilizes provider-managed device encryption services.

Data in Transit: Smoothx connections are secured using HTTPS protected by Transport Layer Security TLS. The data in transit is encrypted using the AES256 standard, the secure hash algorithm SHA2 for message authentication, and RSA as the encryption key exchange mechanism.

All services use one of the strongest block ciphers available, 256-bit Advanced Encryption Standard AES256, to encrypt your data. The provider-managed encryption services provide that the keys are securely managed.