All Sophare’s applications are hosted on Amazon Web Services (AWS), in Europe eu-west-2 (datacenter).
All data access through Sophare applications requires AWS Cognito authentication. Direct data access is restricted to Sophare administrators.
Access to edit company data is restricted to named individuals only.
All AWS components use IAM roles and fine-grained least-privilege-access custom IAM policies to access AWS resources.
Administrative access to the AWS account is only permitted via a two-factor authenticated login held by the two Sophare Founders.
User authentication is provided through AWS Cognito for social identity providers and enterprise identity providers. Multi-factor authentication (MFA) can be enabled upon request. For information about AWS Cognito, please refer to https://aws.amazon.com/cognito/details/.
Data storage is multi-tenant within Sophare. Sophare does not share data storage resources with any other company.
Data is stored with encryption at rest following best practice.
When selecting desired fields as part of adding a new data source, the data is only stored in memory on the client side. Once sensitive/undesired data has been deselected, the data is persisted in storage on AWS. As such, you can choose for sensitive data to never be stored on Sophare servers.
If you decide to terminate your relationship with Sophare, your data and settings will be retained for up to 3 months. After this period, your data and settings will be permanently deleted and cannot be recovered. If you prefer to have your data deleted immediately upon termination, please inform us, and we will fulfill your request.
TLS/SSL (HTTPS) is mandatory for all web requests made to Sophare. Certificates are managed by Amazon’s Certificate Management service, and rotated and updated yearly.
As best practice, Sophare uses AWS Cognito to manage authentication. We recommend our customers use two-factor authentication, particularly on the management application.
Sophare does not share your data with third parties except at your explicit request.
Sophare might provide anonymous, aggregated network insights to our members. When Sophare provides this service, individual or company-specific information will never be shared. You will be notified and given the choice to opt out of being included in the aggregated data.
In order to protect you and your information, Sophare may suspend your use of our applications without notice, pending an investigation, if any security breach is suspected.
Sophare will promptly notify affected customers of any data breaches once the extent of the breach is understood, but no later than within 72 hours.
Sophare conducts postmortem procedures for security or system failures and shares the findings with customers.