Trusted by the most security conscious financial institutions, we have data-security built-in to our culture. Aside from the security features of our platform, we have selected our technology partners and vendors carefully; we also adhere to comprehensive employee training, company policies, confidentiality agreements, and vigorous testing and quality assurance practices that go into every release of our technology.

Physical Infrastructure

Rintagi™ 4D platform is using Amazon Web Services (AWS), a highly trusted and recognized infrastructure provider that has a reputation for providing one of the most secure and reliable data centers in the world.

Reports, Certifications, and Independent Attestations. AWS has in the past successfully completed multiple SAS70 Type II audits, and now publishes a Service Organization Controls 1 (SOC 1) report, published under both the SSAE 16 and the ISAE 3402 professional standards. In addition, AWS has achieved ISO 27001 certification, and has been successfully validated as a Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS).

To more information please click on this link http://aws.amazon.com/security/.

IT Security

The minimum level of access is allowed to your dedicated servers. Firewalls are configured to grant access to necessary users, protocols, and ports; all others are disabled and monitored. All operating systems and third-party software are kept current. Databases and backups can only be accessed through trusted and encrypted authentication.

Every activity performed is tracked for future audit; they include:

• Enhancements or corrections in a new version;
• Deployment date time and the version deployed;
• Logging into the system;
• Backing up of the system;

Your application and data is being backed up every day from Monday to Friday in a private and secure undisclosed location. Weekly, monthly and yearly backup can be arranged for up to six years. We ensure your data is continuously available at your discretion.

Application Security

Rintagi™ built applications include a number of vulnerability prevention measures at various stages of the development and deployment process.

During application design, the following configurations can be set:

• HTTP or HTTPs per page and web service when data encryption is required during transmission;
• Authentication required to restrict access to certain components per page;
• Network-based security when access needs to be restricted to a specific IP range;

During code generation, access controls determine whether the developer has permission to generate and deploy the application and to use any external components, APIs and data models.

Rintagi™ 4D platform generates, optimizes, and compiles C# code and stored procedures with highly secure code patterns as below:

• Compression of server-side view states the content and avoids session data to be exchanged in clear text;
• One-way password hash ensures the highest level of encryption and security for database authentication and access;
• Stored-procedures plus encryption prevents SQL code injection at runtime;
• No late binding or runtime access to any pre-compiled code prevents C# code injection;
• Dedicated database and isolated connection pools prevents unplanned cross application and cross database access at runtime;
• Session identifiers are strongly typed and validated to prevent intrusion on existing sessions from uninvited guests and devices;
• Comprehensive exception handling and error tracing;

End User Security

Each failure attempt to login is tracked. The system will shut down after five (5) unsuccessful logins. Performing “Forget Password” procedure is the only way to regain access to the system.

Out-of-the-box single sign-on capability allows you to unify all your logins across all the applications and databases. After that the user can move seamlessly across applications and databases without additional logins. CAPTCHA can be added easily to make sure the person logging in is human.

Both role-based and membership-based access controls are provided. Users can be provisioned and grant access to one or more roles, representing one or more organizations, or specific permission configuration down to the cell level. These access rights can be applied across applications and databases.

Every access to your application screens, reports, and wizards are tracked automatically. These logs can be filtered by over ten parameters and include the date and time of the access, which user accessed it, etc. This allows you to effectively track down any security issues that may arise.

You own all data maintained in your application. Our engineers only access your servers and databases when it is necessary to perform system management, maintenance, monitoring, and backups.