Security Policy

TestDome follows industry standard practices for storage of passwords, keys and secrets.

TestDome uses TLS ("Transport Layer Security") to encrypt and protect against data tampering when data is in transit.

Data at rest is encrypted using FIPS 140-2 compliant keys and algorithms.

Security Program

TestDome maintains a security management program that includes but is not limited to:

• Executive review, support and accountability for all security related policies and practices.
• Periodic risk assessments of application areas that process sensitive data.
• Prompt review of security incidents affecting the security of the TestDome application, including internal evaluation of root cause and corrective action.
• Comprehensive testing methodology that consists of multiple approaches that are combined in order to maximize coverage for potential issues regarding security, integrity, and resilience of our application.
• Bug bounty program that rewards people for finding and reporting security issues in the TestDome application.

Staff training and policies

TestDome maintains policies and practices that include the following controls and safeguards applied to TestDome staff who have access to data and/or provide support and services to customers:

• Security awareness training;
• Access to the TestDome application infrastructure restricted to only TestDome-approved users with appropriate technical security controls (including two-factor authentication);
• Controls designed to limit access to data to only those TestDome staff on an actual need-to-know basis;
• Separation of duties to prevent a single TestDome employee from controlling all key aspects of a critical transaction or business process related to the TestDome application.

The required infrastructure that ensures the TestDome application's availability is covered by the Microsoft Azure SLA, with a minimum availability of 99.9% of the time.

All data is stored in a redundant manner to ensure its availability in case of data center failures.

Backups of the application database are created periodically and kept for up to 35 days.

The process to deploy the TestDome application is semi-automated and, in the event of an incident, the TestDome application can be restored within a reasonable timeframe.

TestDome employs automated vulnerability scanning tools and comprehensive testing methodology to ensure data is processed in a secure and reliable way.

TestDome seeks external security audits whenever major changes are implemented to the infrastructure or application.

TestDome employs a comprehensive testing methodology that includes automated and manual testing on a separate testing environment before deploying changes to customers.

TestDome maintains a list of users and passwords in the TestDome application's database (which is encrypted at rest).

All users go through an email verification process when they first sign up for TestDome.

Passwords are stored according to NIST guidance on "memorized secrets".

Users are encouraged to use strong passwords whenever they're signing up or changing their passwords.

All failed sign-in attempts are logged and the application detects and blocks brute-force attacks by locking out users with an unusual amount of failed sign-in attempts within a short time period.

All data storage infrastructure is provided by Microsoft Azure and the security of such data is covered by Azure's certifications.

All data at rest is encrypted using FIPS 140-2 compliant encryption

All data in transit is protected by Transport Layer Security ("TLS").

All infrastructure for TestDome's application, including all the infrastructure used to store data, is hosted on Microsoft Azure data centers.

Azure data centers have strict security policies to control physical access to them. These security policies include, but are not limited to, formal access requests and approval, professional security staff, biometric access control mechanisms.

More information about data center physical security can be found here.

Non-sensitive software configuration is maintained as code and managed by our SCM tool. All changes are recorded and can be traced back to the person responsible for making the change.

Sensitive software configuration (such as passwords, secrets, and digital certificates) are stored encrypted on Microsoft Azure KeyVault and access to this information is granted on a need-to-know basis.

All the infrastructure used by TestDome's application is provided by Microsoft Azure and all changes to the infrastructure are logged and can be traced back to whoever made it.

At a technical level TestDome stores data in a way that logically separates data of one customer from another. TestDome also maintains appropriate separation of production and testing environments.

For staff training and policies see the item above titled "Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services".

TestDome's users can decide on how long TestDome will keep their data stored in its servers.

Automated procedures are in place to anonymise data that is older than the period chosen by users.

In addition, users can contact TestDome support channels to request data to be anonymized immediately.

Data may be kept in TestDome backups/logs for an extended period of time, but it is permanently deleted/anonymised once older backups are rotated out by newer ones.

TestDome internally reviews its information security policies to ensure they are still relevant and are being followed.

All employees must acknowledge the information security policies and are required to sign an NDA upon joining the company.

A disciplinary policy is in place for employees that do not adhere to information security policies.

The TestDome application has built-in tools that allows users to export some of their data.

For any data that is not covered by the built-in application tools, TestDome provides support channels where users can request their data to be exported and/or anonymized.