We value your security and privacy
At Cheqroom, our priority is to keep your data safe. Our security approach focuses on penetration testing to ensure our Cloud infrastructure and our applications are bulletproof and the data and privacy of our customers are protected by all means.
Through penetration testing, the implementations of our developers are validated on a security level before rolling them out in a production environment. We perform multiple iterations of security tests for each major release, enforcing confidentiality, integrity, and availability.
Single Sign-On (SSO)
SSO allows you to authenticate users in your own systems without requiring them to enter additional login credentials.
Permissions
We control user access to specific features by creating roles with customizable permissions.
SOC2 Type I Compliance
Cheqroom proudly boasts SOC 2 compliance, affirming its rigorous commitment to safeguarding user data. This certification underscores the implementation of robust controls, ensuring the confidentiality, integrity, and availability of information within the asset management platform.
Uptime
Cheqroom typically reaches an uptime of 99.9% or higher. You can check our past month's stats at https://status.cheqroom.com.
Data encryption
Cheqroom ensures the secure transmission of data by employing 256-bit encryption for all information exchanged. Our API and application endpoints exclusively utilize TLS/SSL, receiving an "A+" rating on Qualys SSL Labs' assessments. Cheqroom enforces robust cipher suites and the implementation of features like HSTS and Perfect Forward Secrecy. Additionally, data is safeguarded at rest through the industry-standard AES-256 encryption algorithm.
Backup and Disaster Recovery
We take backups of our database every 6 hours with point-in-time recovery so that we can quickly recover in case of a disaster. In addition, we store our backups at geographically separated sites so that we can recover even in case of a larger-scale natural disaster. In case of a disaster, Cheqroom has an extensive Business Continuity and Disaster Recovery Plan and yearly tabletop exercises. Cheqroom’s Recovery Time Objective (RTO) for disasters is 48 hours.
Data Hosting and Storage
Cheqroom services and data are hosted in the USA’s Amazon Web Services (AWS) facilities. No billing-related information is stored on Cheqroom servers. Instead, cardholder data is directly sent to our billing management service, Recurly, which is PCI-DSS Level 1 compliant.
Security Incident Response
Our incident response program addresses events that cause disruptions to the quality of our service. This includes defined escalation paths and engaging the appropriate teams to investigate, communicate, and remediate the incident.
Penetration test
Once a year, we engage third-party security experts to perform detailed penetration tests on the Cheqroom application and infrastructure.