Atera’s robust, built-in security is at the center of everything we do — so you can be sure your data is always safe and protected.
Atera subscription services are out of scope for PCI-DSS because we do not process card data on behalf of our customers.
Atera maintains administrative logs as well as logs for account establishment and modifications, including adding or removing users, segments, sources, and destinations.
Atera customers may obtain logs of internal Atera matters related to internal changes to the state of their respective Atera accounts. Common changes are CRUD Operations (Create, Update, Delete) of Accounts, Admin User, etc.
Atera makes it easy for you to add multi-factor authentication to your Atera account login process to bolster account security.
Customer account administrators can easily add and remove account users. Atera has various defined user roles with respective permissions.
Connection to the Atera environment is via SSL/TLS cryptographic protocols, using global step-up certificates, ensuring that our users have a secure connection from their browsers to our service.
Individual user sessions are identified and re-verified with each transaction, using a unique token created at login.
Access List IP Ranges limit unauthorized access by requiring users to log in to Atera from designated IP addresses — typically your company network, designated customer networks or VPN. By using Login IP Ranges, admins can define a range of permitted IP addresses to control access to Atera. Those who try to log in to Atera from outside the designated IP addresses will not be granted access.
Once an Agent is deployed, a unique Key is assigned to it. This key is used for authentication purposes. All communications between Agents and Atera’s Cloud are verified by this unique Key and conducted via secure socket layer/transport layer security (SSL/TLS).
While using the Atera Remote Control tool, a virtual tunnel is created between the Atera user and the target computer. All data transferred between the User and the Agent is encrypted. Both the Atera User & Agent connect only via TCP port 443.
Data is encrypted at-rest using AES-256.
We encrypt data in transit using HTTPS/TLS. The TLS version supported is currently TLS 1.2 or newer.
Users’ account passwords are encrypted and hashed with a SHA 256 algorithm.
Atera is committed to your privacy and, where applicable, adheres to the EU General Data Protection Regulations known as GDPR. For more information about Atera and GDPR, check our GDPR awareness notice at https://www.atera.com/gdpr-awareness-notice/
Atera retains customer data in accordance with customer instructions contained in their respective services agreements. Following customer account termination, access is removed, and the customer data associated with the account is logically deleted and then overwritten. When media that hosted customer data is no longer useful, it is destroyed in compliance with NIST SP 800-88 Revision 1 Guidelines for Media Sanitation and DoD security guidelines.
We address data processing in our service agreement terms and offer a data processing addendum to our customers.
To request a DPA, please contact: [email protected]
Customers can request data removal by contacting Atera’s privacy support. Any data removal request received from a data subject associated with a customer will be referred to the customer in question.
For any concerns, requests, or to exercise your data protection rights, please contact: [email protected]
Our appointed Data Protection Officer is responsible for ensuring that all our data protection measures are up-to-date and all procedures are followed. The DPO works with experienced security professionals (CISO, CISM, CRISC, CISSP, CISA, CIPM, CEH, CIPPE, CDPSE).
In the event of any actual or reasonably suspected information security breach or other incident affecting the security or integrity of your data, Atera will adhere to the policies defined in the Atera Information Security Incident Response Plan and will notify you in accordance with applicable law.
Atera operates a formal security incident management process under a related policy and procedure. Escalation procedures exist to ensure the timely communication of any security incident through the management chain and to any affected customers without undue delay.
Atera uses the Microsoft Azure platform infrastructure because it has been architected to be one of the most flexible, reliable, and secure cloud environments available today, allowing our customers to benefit from this data infrastructure.
Our infrastructure is divided into multiple, geographically dispersed facilities in data centers designed for maximum security and availability. All locations employ industry best-practices, including badge and biometric access entry systems, extra power sources, extra air conditioning units, and fire suppression systems. Security personnel and cameras monitor these locations 24 hours a day, 365 days a year. Only authorized personnel are allowed inside these data centers and all visits are logged.
We have designed our subscription service data collection environment for high availability; no less than 99.75%.
We enable auto-scaling in the cloud.
Atera’s cloud infrastructure can scale to process data from millions of devices. True cloud scaling is achieved by auto-scaling the cloud infrastructure with no impact to the end user accessing or writing data.
Atera has deployed Cloudflare Security Services for both Web Application Firewall, Denial of Service protection, and Content Delivery Network.
Atera services are deployed to benefit from the infrastructure superfluousness of the Microsoft Azure platform.
Atera follows a change management process for changes to the production environment. All code changes must undergo a peer code review and include automated unit, functional, and security testing. Testing is performed after deployments to validate application functionality. If validation fails, the application is rolled back to its previous version.
Atera uses Azure Log Analytics and application insights to monitor its systems to detect service-related issues. The Atera team is alerted 24/7 when the threshold criteria are exceeded.
Our service agreements enable the confidential treatment of confidential customer information, including customer data. We require all our employees and contractors as well as vendors to sign confidentiality agreements to ensure the absolute protection of confidential information.
We train all new employees about their confidentiality, privacy, and information security obligations as part of their onboarding training. A compulsory annual security and privacy training ensures employees refresh their knowledge and understanding. Engineering teams receive further training related to their work duties and access.
Our employee workstations are automatically locked after a pre-determined period of non-use via the MDM system we have implemented.
All employee workstations are encrypted and wiped at the time of decommission using DoD standards.
Atera follows the principle of “least privilege” in governing employee access to our systems. Access to our customers’ data is limited to legitimate business needs, including activities needed to support our customers’ use of our services.
We map network accounts directly to our employees using a unique identifier; generic administrative accounts are not used. We periodically review employee access to internal systems to ensure that employees’ access rights and patterns are in line with their current positions.
A formal employee termination notification process exists, which is initiated by our Human Resources (“HR”) department. Upon notice by HR, all physical and system accesses are promptly revoked.
Atera has implemented appropriate controls to restrict physical access to its offices.
Our cloud service providers have implemented robust security measures to control physical access to the data processing facilities we use.
Atera’s employee workstations use Zero Trust controls to provide end-to-end network encryption, layered security, and identity access management with MFA in-order to provide a private, secure connection both to the internet and to Atera’s work-related network assets.
All remote connections are monitored regularly, and employees are alerted if they are disconnected from the network, or if any other security notifications are triggered.
Atera has implemented an integrated Business Continuity and Disaster Recovery Policy and maintains related plans under the policy. Please see the text under ‘Disaster Recovery Plan’ for more information on this topic.
Atera maintains essential disaster avoidance, readiness, and recovery planning capabilities through the use of multiple geographically dispersed data centers, our platform architecture, offsite data backup, and remote access capabilities. We also maintain a Business Continuity and Disaster Recovery Policy and related plans, and test them on a regular basis.
Atera stores all customer data on Microsoft Azure storage systems, utilizing hot backups stored in secure Azure facilities offsite from production facilities. Access to backup media is highly restricted.
Atera hosts its data and application on Microsoft Azure, for its production infrastructure environment.
Azure utilizes the safeguards mentioned here which also includes:
Access control and physical security
Fire detection and suppression
Atera is hosted on the gold-standard in Cloud Security: Microsoft Azure.
Azure data centers maintain robust physical security standards and are ISO 27001, ISO 27017, ISO 27018, ISO 27032, HIPAA, FedRAMP, SOC-1, and SOC-2 compliant.
For more information regarding Azure’s compliance reports, please see here.
Atera provides its subscription services using a multi-tenant architecture with the data in each customer account logically separated from other accounts. The data is encrypted at-rest using AES-256.
Microsoft Azure data centers — certified as compliant with the following ISO standards: ISO 27001:2013, ISO 27017:2015, and ISO 27018:2019, ISO 27701:2020.
Microsoft Azure data centers are certified with SOC 2 Type 2 Security, Confidentiality, Availability, and Privacy Trust Principles.
For more information, please navigate to the following link that further describes Microsoft’s security around the Azure Infrastructure.
Zero-trust (ZT) is the term for an evolving set of cybersecurity paradigms that move defenses from static, network-based parameters to focus on users, assets, and resources.
Atera applies a zero-trust architecture (ZTA) and uses zero-trust principles to plan and build its infrastructure and workflows, so no implicit trust is granted to assets or user accounts based solely on their physical or network location.
We have an independent, third-party security vendor who conducts manual penetration testing of our internal and external infrastructure and services on a quarterly basis. This manual testing is complemented by automated testing using a variety of commercially available testing tools executed monthly.
Atera uses several automated scanning tools to scan for both infrastructure and application security vulnerabilities on a frequent basis. Scans are applied to every code build and prior to code mergers.
Source code is regularly scanned for any vulnerabilities prior to production going live.