Protecting our customers' data is fundamental to how we build and operate the Vistify platform. This page summarizes the security practices we have in place.
1. Infrastructure & Hosting
- The Vistify platform runs on Amazon Web Services (AWS) in the United States. Physical and environmental security of the underlying data centers is managed by AWS.
- Production runs in a dedicated, isolated network environment, separate from development, staging, and test environments.
2. Encryption
- All connections to the Vistify platform are encrypted in transit using TLS. Requests made over HTTP are automatically redirected to HTTPS.
- Customer media, files, and document data are stored in services that encrypt data at rest.
3. Network Protection
- Public endpoints sit behind managed load balancers protected by a web application firewall (AWS WAF) with managed DDoS-mitigation rules, and API traffic is restricted to approved paths.
- Network access between components is restricted by firewall rules that allow only the traffic each service requires. Firewall rules are reviewed at least annually.
4. Access Control
- Access to production systems follows the principle of least privilege and is granted based on role.
- Console access to our cloud infrastructure requires multi-factor authentication.
- Every infrastructure account is assigned to an accountable owner.
5. Vulnerability Management
- Our infrastructure, container images, serverless functions, and application dependencies are scanned for known vulnerabilities on a continuous basis.
- Findings are prioritized by severity, tracked to resolution, and verified by rescanning once fixed.
6. Monitoring & Logging
- We use automated threat detection to identify suspicious activity in our cloud environment.
- Administrative activity across our cloud environment is logged, with log-file integrity validation enabled.
7. Secure Development
- Changes to production code are made through pull requests on protected branches and are promoted through staging and test environments before release.
- Operating system and platform updates for our application servers are applied through scheduled, managed maintenance.
8. Backups & Incident Response
- Production databases are backed up automatically.
- We maintain a documented incident response plan for identifying, containing, and communicating security events.
9. Policies & Vendors
- Vistify maintains management-approved information security policies, including access control, cryptography, operations security, incident response, business continuity, and third-party management.
- Vendors that support our services are reviewed under our third-party management policy.
10. Report a Security Issue
If you believe you have found a security vulnerability in Vistify's website or services, please contact us at support@vistifyinc.com with a description of the issue and steps to reproduce it. Please do not access or modify data that does not belong to you.