Security at Intento
Language Hub for Localization
Intento relies on Amazon Web Services (AWS) to power its public cloud infrastructure, leveraging a range of services such as web hosting, user administration, backend API management, computational capabilities, database functionality, monitoring tools, and automation features. Intento does not employ a private or hybrid cloud model.
Audits
Intento has established a comprehensive audit mechanism aimed at ongoing surveillance to detect vulnerabilities, instances of non-conformity, and misconfigurations. This auditing process involves internal teams and reputable external firms with accreditation.
Additionally, Intento undergoes regular ISO 27001 audits to uphold compliance standards. Should you require it, the audit report is accessible upon request.
Security Logs
Intento has a robust intrusion detection system where any suspicious changes inside the infrastructure or the employees endpoint devices are being monitored and flagged. Combining it with the incident response policy the intrusion detection completes the whole process.
Business Continuity
Intento has integrated a robust system to enhance reliability, backup procedures, and business continuity. Leveraging AWS services, our infrastructure is fortified to withstand natural disasters across multiple availability zones. We conduct daily backups of production databases, securely storing them using AWS services, encrypting them, and controlling access based on the principle of least privilege. Annual testing is conducted to validate the effectiveness of backup recovery and deployment protocols.
Furthermore, our business continuity and disaster recovery plans undergo annual testing to maintain operational resilience.
Architecture and Data Segregation
Intento manages a multi-tenant software-as-a-service platform, where all users share the same infrastructure. To maintain the integrity and privacy of Customer Data, as outlined in your contractual agreement with Intento regarding service usage, we’ve instituted rigorous protocols. These protocols incorporate access controls and the association of Customer Data with distinct customer identifiers, ensuring logical segregation within our system.
Intrusion Detection
Intento maintains a robust intrusion detection system that vigilantly monitors and flags any suspicious activity occurring within our infrastructure or on employee endpoint devices. This system, when integrated with our incident response policy, ensures a comprehensive approach to security.
Security Incidents
Intento upholds a robust and meticulously outlined incident response plan designed to address a spectrum of potential incidents. This plan undergoes annual evaluations and is distributed to all relevant stakeholders.
Each incident is thoroughly logged in Intento’s security incident register, with all response measures meticulously documented and subjected to post-incident scrutiny. In the event of any unauthorized disclosure of Customer Data by Intento or its representatives, affected customers are promptly notified in compliance with legal mandates.
Personnel Security
Intento implements rigorous personnel practices to maintain effective control and oversight over its staff.
Our hiring procedures entail background checks and assessments tailored to job roles and locations. All employees undergo information security and privacy training during onboarding, supplemented by annual security refreshers. Adherence to our security policies is mandatory for all employees.
These policies encompass:
- Role-based access controls following the principle of least privilege, with monitored approval processes.
- Execution of Non-Disclosure Agreements or equivalent confidentiality agreements.
- Regular privacy and security training sessions.
- Immediate revocation of access upon termination of employment.
- Physical access restrictions, including key cards and video surveillance.
- Comprehensive audit logging of all backend infrastructure access and actions.
- Proactive management of threat intelligence, including dark web monitoring.
- Utilization of FIDO2 compliant biometric or security keys, strong password requirements, default multi-factor authentication, and password management protocols.
- Business continuity policy
- Privacy policy
- Supplier policy
- Information security policy
- Access control policy
- Secure development policy (SSDLC)
- Physical security policy
- Cryptography policy
- Password policy
- Code of conduct: Security
- Penetration testing policy
- Secure engineering policy
- Responsible disclosure policy
- Mobile device policy
- Testing policy
- Logging policy
- Information classification policy
- Backup policy
- Information retention policy
- Documented information policy
- Network security policy
- Vulnerability Management Policy
- Test policy workflow
- Incident response policy
Customers Data Sharing
Intento operates distinctly from data collection companies; hence, we abstain from gathering any personal data from customers to facilitate our operations. Within Intento’s realm, we exclusively translate the content provided by our customers. To mitigate the potential exposure of personal data, we advocate for customers to submit only the specific text requiring translation.
Access Management
Intento uses a centralized system for managing identities, governing access to all key systems and physical access to sensitive office locations. Administrators and incident responders can use this to easily terminate and disable all authenticated sessions. All access is granted based on approved requests and we conduct quarterly reviews of access to any sensitive system.
Company wide 2FA requirement
To protect Intento staff identities, we employ industry leading security practices, such as requiring all staff members to use 2-factor-authentication. Employees are encouraged to use FIDO2 compliant authentication factor, such as a physical security key or WebAuthn or utilize a time based token.
Audit Logging
We meticulously log every access and action taken by Intento staff, as well as all customer events. This includes recording details such as the type of device used, IP addresses, and any registered abnormalities regarding location, time or unusual actions.
Endpoint management
We implement rigorous security measures, including locking screens, encrypting entire disks, deploying anti-malware software, employing endpoint detection and response tools, enabling remote wiping and locking functions, and ensuring software stays current.
Host Management
We maintain constant surveillance over our cloud infrastructure to detect any misconfigurations, exposure risks, vulnerabilities, and issues related to patch management.
Application Security
We’ve implemented a secure software development lifecycle policy. New features and significant changes undergo threat modeling and review processes. Continuous static code scanning and software composition analysis help detect and mitigate potential vulnerabilities early. Additionally, we contract with security services vendors for annual penetration testing to ensure comprehensive evaluation of our systems’ resilience.
Change Management
Every alteration to application code adheres to our change management process, meticulously tracking system modifications to confirm their necessity, safety, and enhancement of system functionality. Additionally, all code adjustments undergo peer review before deployment to production, ensuring quality and reliability.