CAIQ-Lite 3.1 Security Assessment Questionnaire

Application Security

AIS-01.2

Do you use an automated source code analysis tool to detect security defects in code prior to production?

We use SonarLint to give developers continuous feedback on potential security issues in their code.

We also use SonarQube for automated analysis and scanning prior to code merging to the main branches. If the analysis fails, the branch will not go into production.

(SaaS only) Do you review your applications for security vulnerabilities and address any issues prior to deployment to production?

We periodically review possible vulnerabilities in dependencies with Snyk in both the back and front end of the application. If a vulnerability is found, an associated ticket will be created and the code will not go into production until it is solved.

AIS-02.1

Are all identified security, contractual, and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets, and information systems?

Only each customer has access to their own data through their own Jira Cloud instance, never directly. They must first log in to Atlassian SSO. More information available here: Information security policy

AIS-03.1

Do your data management policies and procedures require audits to verify data input and output integrity routines?

We check data input and output for errors and corrupted data. These are checked from unit, integration and end-to-end testing to acceptance testing by human review. Our databases are encrypted at rest. Our employees' access to this data is restricted to a very limited group of systems personnel. Customer data input and output is managed by Role Level Security to ensure that information is kept isolated. We make an audit log in every I/O operations in database.

Independent Audits

AAC-02.1

Do you allow tenants to view your SOC2/ISO 27001 or similar third-party audit or certification reports?

We do not yet have SOC2/ISO 27001 certification, we are working on it and will probably have it in early 2024. We have our infraestrucure under Google Cloud Platform, the certifications are available in the link below.

Cloud compliance and regulations resources

Do you conduct network penetration tests of your cloud service infrastructure at least annually?

No, we don’t make network penetration tests yet. We have done it occasionally but not annually.

Do you conduct application penetration tests of your cloud infrastructure regularly as prescribed by industry best practices and guidance?

We are part of the Atlassian Marketplace Bug Bounty Program in which specialised testers run penetration and security tests against our Cloud applications and report the vulnerabilities detected. Once published, our engineers are required to fix each vulnerability within a set timeframe depending on the importance of the vulnerability.

AAC-03.1

Do you have a program in place that includes the ability to monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements?

There is no system available to monitor updates, but changes are manually analyzed and, if there are any, the necessary actions can be taken to adapt and meet the requirements.

Business Continuity Testing

BCR-02.1

Are business continuity plans subject to testing at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness?

All the information about the Business Continuity Plans are available in: Business continuity & disaster recovery plan

BCR-10.1

Are policies and procedures established and made available for all personnel to adequately support services operations’ roles?

We use customer documentation spaces for our applications.

We have a playbook where we document all support and service processes for our customers. The support backup rotates through each element of the team to ensure that each member has knowledge of how to serve our customers.

We have specific internal training spaces and faqs to try to solve the vast majority of unforeseen issues that may arise.

BCR-11.1

Do you have technical capabilities to enforce tenant data retention policies?

We have a DPO who has implemented mechanisms to guarantee tenant retention policies.

Have you implemented backup or recovery mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements?

We have mechanisms to backup and recovery of our database instances provided by Google Cloud Platform

Do you test your backup or redundancy mechanisms at least annually?

We use to test of the backup and redundancy mechanisms but not annually.

Unauthorized Software Installations

CCC-04.1

Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems?

The source code of the Production branch can only be changed by manual reviews of the code to be changed plus several automatic security and acceptance checks. Most infrastructure changes are made with automated scripts that are subject to the same validation process. For any changes to the infrastructure that are not scripted, only a limited group of people can implement them manually.

E-commerce Transactions

DSI-03.1

Do you provide standardized (e.g. ISO/IEC) non-proprietary encryption algorithms (3DES, AES, etc.) to tenants in order for them to protect their data if it is required to move through public networks (e.g., the Internet)?

We use HTTPS traffic when sending information.

Do you utilize open encryption methodologies any time your infrastructure components need to communicate with each other via public networks (e.g., Internet-based replication of data from one environment to another)?

Our components don’t communicate with each other using public networks.

DSI-05.1

Do you have procedures in place to ensure production data shall not be replicated or used in non-production environments?

Only a certain very limited group has access to production data and not manually. No replication of production environments is done under any circumstances.

The development and application databases, which are necessary for monitoring and managing applications, are separate from the production databases. They also have different authentication for access them.

DSI-07.1

Do you support the secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data?

We have the ability to remove customer data from the production database but not from backups. These backups are retained for 7 days, after which they are deleted.

Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of tenant data once a customer has exited your environment or has vacated a resource?

Not applicable. We don’t offer computing resources to customers.

Asset Management

DCS-01.2

Do you maintain a complete inventory of all of your critical assets located at all sites/ or geographical locations and their assigned ownership?

We maintain an inventory of critical assets, and each asset has a nominated owner.

DCS-02.1

Are physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) implemented for all areas housing sensitive data and information systems?

All servers housing sensitive data and information systems are implementd physical security perimeters.

We use Google Cloud Platform and the regarding information is available here: Data and Security – Data Centers – Google

DCS-09.1

Do you restrict physical access to information assets and functions by users and support personnel?

Only authorized personnel have physical access to information assets and functions

Key Generation

EKM-02.1

Do you have a capability to allow creation of unique encryption keys per tenant?

We use different unique JWT to authorise the communication for each user.

EKM-03.1

Do you encrypt tenant data at rest (on disk/storage) within your environment?

We use Google services to store customer data. All data stored is encrypted at the storage layer using the Advanced Encryption Standard (AES) algorithm, AES-256; using cryptographic library, Tink, which includes our FIPS 140-2 validated module to implement encryption consistently across Google Cloud.

Baseline Requirements

GRM-01.1

Do you have documented information security baselines for every component of your infrastructure (e.g., hypervisors, operating systems, routers, DNS servers, etc.)?

All our infrastructure provisioning is automated, and any changes to the templates must go through a code review process.

GRM-06.1

Are your information security policies and procedures made available to all impacted personnel and business partners, authorized by accountable business role/function and supported by the information security management program as per industry best practices (e.g. ISO 27001, SOC 2)?

We are in the process of acquiring ISO-27001 certification and therefore intend to align our security policies in order to achieve this.

We share this policies with anyone that request them.

GRM-07.1

Is a formal disciplinary or sanction policy established for employees who have violated security policies and procedures?

There is a disciplinary process that is governed by the provisions of the workers' statute.

GRM-09.1

Do you notify your tenants when you make material changes to your information security and/or privacy policies?

We send email when we have done any changes in our information security and/or privacy policies. However we maintain the privacy and security policies publicly available on Information security policy

Do you perform, at minimum, annual reviews to your privacy and security policies?

We perform an annual review of our privacy and security policies.

Asset Returns

HRS-01.1

Upon termination of contract or business relationship, are employees and business partners adequately informed of their obligations for returning organizationally-owned assets?

There is a procedure for the safe return of assets.

HRS-02.1

Pursuant to local laws, regulations, ethics, and contractual constraints, are all employment candidates, contractors, and involved third parties subject to background verification?

We ensure that all employees considered candidates and contractors for the offered position comply with the legal requirements and regulations considered for the characteristics of the position.

HRS-03.1

Do your employment agreements incorporate provisions and/or terms in adherence to established information governance and security policies?

Adherence to established company policies, including information security policies, is a requirement in all employment agreements. All personnel are required to sign an NDA and Confidentiality Agreement as a condition of employment.

HRS-04.1

Are documented policies, procedures, and guidelines in place to govern change in employment and/or termination?

There are procedures that govern any change in employment and/or termination of an employee.

HRS-09.5

Are personnel trained and provided with awareness programs at least once a year?

A plan is prepared annually with the information security training actions planned for that year and approved by the Security Committee

Audit Tools Access

IAM-01.1

Do you restrict, log, and monitor access to your information security management systems (e.g., hypervisors, firewalls, vulnerability scanners, network sniffers, APIs, etc.)?

By default we have restricted all of our systems to some specific users and we monitor access to our information security systems at least annually.

Do you monitor and log privileged access (e.g., administrator level) to information security management systems?

All our infrastructure has restricted access depending on the role required. Developers have access to the logs and the SRE team has access to the infrastructure.

IAM-02.1

Do you have controls in place ensuring timely removal of systems access that is no longer required for business purposes?

To ensure the security of our internal systems and cloud infrastructure, we have implemented an automated process that revokes access for terminated employees. This ensures that ex-employees no longer have access to any sensitive information or data that could potentially compromise our organization's security. This process is initiated as soon as an employee's termination is recorded in our system, and their access is immediately revoked without any manual intervention required. This approach allows us to maintain a robust security posture and safeguard against potential security breaches that could arise from unauthorized access to our systems.

IAM-04.1

Do you manage and store the identity of all personnel who have access to the IT infrastructure, including their level of access?

We store information on all employees who have access to the infrastructure. All our infrastructure has restricted access depending on the role required.

IAM-06.1

Are controls in place to prevent unauthorized access to your application, program, or object source code, and assure it is restricted to authorized personnel only?

Source code is managed by version control systems where each developer must authenticate before accessing the platform or uploading any changes.
The user accounts of these developers as well as the roles they each have are centralised at one point.

Are controls in place to prevent unauthorized access to tenant application, program, or object source code, and assure it is restricted to authorized personnel only?

We do not have source code for applications that we do not own. However, they would be based on the same authentication process and roles as our applications.

IAM-08.1

Do you document how you grant, approve and enforce access restrictions to tenant/customer credentials following the rules of least privilege?

Tenants/customers do not have access to our infrastructure, source code. They can only create support tickets in our Jira Service Management.

IAM-10.1

Do you require a periodical authorization and validation (e.g. at least annually) of the entitlements for all system users and administrators (exclusive of users maintained by your tenants), based on the rule of least privilege, by business leadership or other accountable business role or function?

Our business leaderships manage the periodical authorization and validation of the system users and the least privilege rules.

IAM-11.1

Is timely deprovisioning, revocation, or modification of user access to the organizations systems, information assets, and data implemented upon any change in status of employees, contractors, customers, business partners, or involved third parties?

When an employee leaves the company, his or her access to any infrastructure is revoked with the termination date. There is no third party access to our systems.

Audit Logging / Intrusion Detection

IVS-01.1

Are file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation by root cause analysis, and response to incidents?

We don’t have tools to detect intrusion and network integrity.

Is physical and logical user access to audit logs restricted to authorized personnel?

Access to audit logs is restricted to authorized personnel according to the Access Management Policy.

Are audit logs reviewed on a regular basis for security events (e.g., with automated tools)?

Audit logs are not reviewed with automated tools?

IVS-03.1

Do you use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference?

We use Google Cloud Platform virtual machines which are synchronized using NTP protocol.

IVS-07.1

Are operating systems hardened to provide only the necessary ports, protocols, and services to meet business needs using technical controls (e.g., antivirus, file integrity monitoring, and logging) as part of their baseline build standard or template?

We adhere to a security-first approach by using standard virtual machines, where only essential ports, protocols, and services are enabled to meet our business requirements.

IVS-08.1

For your SaaS or PaaS offering, do you provide tenants with separate environments for production and test processes?

We do not offer our tenants access to non-production environments. They always run in production but under trial licences.

Do you logically and physically segregate production and non-production environments?

Our production environments are completely separate from all development environments, both physically and logically.

IVS-09.1

Are system and network environments protected by a firewall or virtual firewall to ensure business and customer security requirements?

Access to the application backend is protected by firewall rules configured in Google Cloud Platform network.

IVS-11.1

Do you restrict personnel access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems based on the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls and TLS-encapsulated communications to the administrative consoles)?

We follow the principle of least privilege for all access to our entire infrastructure. We have two-factor authentication for any login.

IVS-12.1

Are policies and procedures established and mechanisms configured and implemented to protect the wireless network environment perimeter and to restrict unauthorized wireless traffic?

Policies and procedures are established to protect the wireless network environment perimeter

Are policies and procedures established and mechanisms implemented to ensure wireless security settings are enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, SNMP community strings)?

Wireless security settings are enabled with strong encryption. We replace vendor default settings

Are policies and procedures established and mechanisms implemented to protect wireless network environments and detect the presence of unauthorized (rogue) network devices for a timely disconnect from the network?

Not implemented yet

APIs

IPY-01.1

Do you publish a list of all APIs available in the service and indicate which are standard and which are customized?

We have all our API’s endpoint documented in a public site. All of them are standard.

Approved Applications

MOS-03.1

Do you have a policy enforcement capability (e.g., XACML) to ensure that only approved applications and those from approved application stores can be loaded onto a mobile device?

Not implemented yet

Incident Management

SEF-02.1

Do you have a documented security incident response plan?

Is available information here: Security Incident Response Policy

Have you tested your security incident response plans in the last year?

Not implemented yet

SEF-03.1

Are workforce personnel and external business relationships adequately informed of their responsibility, and, if required, consent and/or contractually required to report all information security events in a timely manner?

We ensure that all our contractual agreements and notifications contain clear communication and instructions on how to report any information security events promptly.

Do you have predefined communication channels for workforce personnel and external business partners to report incidents in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations?

We have predefined communication channels to report security incidents

SEF-04.4

Do you enforce and attest to tenant data separation when producing data in response to legal subpoenas?

We ensure the separation of information by customer through the use of RLS (row level security), which provides us with the ability to demonstrate the separation of information in the event of a legal inquiry.

Incident Reporting

STA-02.1

Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g., portals)?

If customers are affected, we utilize digital methods such as email to notify them of security incidents.

STA-03.1

Do you collect capacity and use data for all relevant components of your cloud service offering?

Yes, we monitor our systems data and computing resources usage in Google Cloud Platform.

STA-05.4

Do third-party agreements include provision for the security and protection of information and assets?

Our suppliers must comply with the information security requirements of the Information Security Policy.

Do you have the capability to recover data for a specific customer in the case of a failure or data loss?

Yes, we do have manual mechanisms that would allow us to suspend service to all of our customers if necessary, although this would only be done in a catastrophic scenario.

STA-07.4

Do you provide tenants with ongoing visibility and reporting of your operational Service Level Agreement (SLA) performance?

Information available in Service Level Agreement

STA-09.1

Do you mandate annual information security reviews and audits of your third party providers to ensure that all agreed upon security requirements are met?

Not applicable, our suppliers undergo regular and proactive audits to ensure they meet our security and compliance standards.

Antivirus / Malicious Software

TVM-01.1

Do you have anti-malware programs that support or connect to your cloud service offerings installed on all of your IT infrastructure network and systems components?

We have antivirus programs on our IT infrastructure network and systems components

TVM-02.5

Do you have a capability to patch vulnerabilities across all of your computing devices, applications, and systems?

We can patch all our computing devices using dockerization and virtualization mechanisms in Google Cloud Platform.

TVM-03.1

Is mobile code authorized before its installation and use, and the code configuration checked, to ensure that the authorized mobile code operates according to a clearly defined security policy?

Not applicable.