Security at Atera

Atera’s robust, built-in security is at the center of everything we do — so you can be sure your data is always safe and protected.

 

COMPLIANCE

 

PCI-DSS:

Atera subscription services are out of scope for PCI-DSS because we do not process card data on behalf of our customers.

 

PRODUCT SECURITY

Audit logs:

Atera maintains administrative logs as well as logs for account establishment and modifications, including adding or removing users, segments, sources, and destinations.

Atera customers may obtain logs of internal Atera matters related to internal changes to the state of their respective Atera accounts. Common changes are CRUD Operations (Create, Update, Delete) of Accounts, Admin User, etc.

Multi-factor authentication:

Atera makes it easy for you to add multi-factor authentication to your Atera account login process to bolster account security.

Role-based access control (RBAC):

Customer account administrators can easily add and remove account users. Atera has various defined user roles with respective permissions.

 

DATA SECURITY

Data encrypted at-rest:

Data is encrypted at-rest using AES-256.

Data encrypted in-transit:

We encrypt data in transit using HTTPS/TLS. The TLS version supported is currently TLS 1.2 or newer.

Passwords encryption:

Users’ account passwords are encrypted and hashed with a SHA 256 algorithm.

 

PRIVACY

Privacy Policy:

The Atera Privacy Policy describes how we collect, use, and handle personal information when you use our platform, website(s), app(s), data analytics software, and other services.

Visit our privacy policy here.

 

GDPR

Atera is committed to your privacy and, where applicable, adheres to the EU General Data Protection Regulations known as GDPR. For more information about Atera and GDPR, check our GDPR awareness notice at
https://www.atera.com/gdpr-awareness-notice/

 

Data retention policy:

Atera retains customer data in accordance with customer instructions contained in their respective services agreements. Following customer account termination, access is removed, and the customer data associated with the account is logically deleted and then overwritten. When media that hosted customer data is no longer useful, it is destroyed in compliance with NIST SP 800-88 Revision 1 Guidelines for Media Sanitation and DoD security guidelines.

Data processing addendum:

We address data processing in our service agreement terms and offer a data processing addendum to our customers.

To request a DPA, please contact: [email protected]

Data removal requests:

Customers can request data removal by contacting Atera’s privacy support. Any data removal request received from a data subject associated with a customer will be referred to the customer in question.

For any concerns, requests, or to exercise your data protection rights, please contact: [email protected]

 

Data Protection Officer (DPO)

Our appointed Data Protection Officer is responsible for ensuring that all our data protection measures are up-to-date and all procedures are followed. The DPO works with experienced security professionals (CISO, CISM, CRISC, CISSP, CISA, CIPM, CEH, CIPPE, CDPSE).

 

INCIDENT MANAGEMENT AND RESPONSE

Data breach notification:

In the event of any actual or reasonably suspected information security breach or other incident affecting the security or integrity of your data, Atera will adhere to the policies defined in the Atera Information Security Incident Response Plan and will notify you in accordance with applicable law.

Incident Response Plan (IRP):

Atera operates a formal security incident management process under a related policy and procedure. Escalation procedures exist to ensure the timely communication of any security incident through the management chain and to any affected customers without undue delay.

Availability and reliability:

Atera uses the Microsoft Azure platform infrastructure because it has been architected to be one of the most flexible, reliable, and secure cloud environments available today, allowing our customers to benefit from this data infrastructure.

 

Our infrastructure is divided into multiple, geographically dispersed facilities in data centers designed for maximum security and availability. All locations employ industry best-practices, including badge and biometric access entry systems, extra power sources, extra air conditioning units, and fire suppression systems. Security personnel and cameras monitor these locations 24 hours a day, 365 days a year. Only authorized personnel are allowed inside these data centers and all visits are logged.

 

We have designed our subscription service data collection environment for high availability; no less than 99.75%.

 

Auto-scaling:

We enable auto-scaling in the cloud.

Atera’s cloud infrastructure can scale to process data from millions of devices. True cloud scaling is achieved by auto-scaling the cloud infrastructure with no impact to the end user accessing or writing data.

 

Denial of Service (DoS) protection:

Atera has deployed Cloudflare Security Services for both Web Application Firewall, Denial of Service protection, and Content Delivery Network.

 

Infrastructure redundancy:

Atera services are deployed to benefit from the infrastructure superfluousness of the Microsoft Azure platform.

 

Quality assurance testing:

Atera follows a change management process for changes to the production environment. All code changes must undergo a peer code review and include automated unit, functional, and security testing. Testing is performed after deployments to validate application functionality. If validation fails, the application is rolled back to its previous version.

 

Service monitoring:

Atera uses Azure Log Analytics and application insights to monitor its systems to detect service-related issues. The Atera team is alerted 24/7 when the threshold criteria are exceeded.

Status page

 

ORGANIZATIONAL SECURITY

Confidentiality agreements:

Our service agreements enable the confidential treatment of confidential customer information, including customer data. We require all our employees and contractors as well as vendors to sign confidentiality agreements to ensure the absolute protection of confidential information.

 

Employee security training:

We train all new employees about their confidentiality, privacy, and information security obligations as part of their onboarding training. A compulsory annual security and privacy training ensures employees refresh their knowledge and understanding. Engineering teams receive further training related to their work duties and access.

 

Employee workstations automatically locked:

Our employee workstations are automatically locked after a pre-determined period of non-use via the MDM system we have implemented.

 

Employee workstation encryption:

All employee workstations are encrypted and wiped at the time of decommission using DoD standards.

 

Limited employee access (principle of least privilege):

Atera follows the principle of “least privilege” in governing employee access to our systems. Access to our customers’ data is limited to legitimate business needs, including activities needed to support our customers’ use of our services.

 

We map network accounts directly to our employees using a unique identifier; generic administrative accounts are not used. We periodically review employee access to internal systems to ensure that employees’ access rights and patterns are in line with their current positions.

 

A formal employee termination notification process exists, which is initiated by our Human Resources (“HR”) department. Upon notice by HR, all physical and system accesses are promptly revoked.

 

Physical access control:

Atera has implemented appropriate controls to restrict physical access to its offices.

Our cloud service providers have implemented robust security measures to control physical access to the data processing facilities we use.

 

Secure remote network access:

Atera’s employee workstations use Zero Trust controls to provide end-to-end network encryption, layered security, and identity access management with MFA in-order to provide a private, secure connection both to the internet and to Atera’s work-related network assets.

All remote connections are monitored regularly, and employees are alerted if they are disconnected from the network, or if any other security notifications are triggered.

 

BUSINESS CONTINUITY

Business continuity plan:

Atera has implemented an integrated Business Continuity and Disaster Recovery Policy and maintains related plans under the policy. Please see the text under ‘Disaster Recovery Plan’ for more information on this topic.

 

Disaster Recovery Plan:

Atera maintains essential disaster avoidance, readiness, and recovery planning capabilities through the use of multiple geographically dispersed data centers, our platform architecture, offsite data backup, and remote access capabilities. We also maintain a Business Continuity and Disaster Recovery Policy and related plans, and test them on a regular basis.

 

Data backups:

Atera stores all customer data on Microsoft Azure storage systems, utilizing hot backups stored in secure Azure facilities offsite from production facilities. Access to backup media is highly restricted.

 

Environmental safeguards:

Atera hosts its data and application on Microsoft Azure, for its production infrastructure environment.

Azure utilizes the safeguards mentioned here.

  • Climate control
  • Fire and water damage protection
  • Health and safety
  • Power and Energy efficiency

 

INFRASTRUCTURE

Atera is hosted on the gold-standard in Cloud Security: Microsoft Azure.

Azure data centers maintain robust physical security standards and are ISO 27001, ISO 27017, ISO 27018, ISO 27032, HIPAA, FedRAMP, SOC-1, and SOC-2 compliant.

For more information regarding Azure’s compliance reports, please see here.

Multi-tenant architecture:

Atera provides its subscription services using a multi-tenant architecture with the data in each customer account logically separated from other accounts. The data is encrypted at-rest using AES-256.

ISO 27001 – Data Center:

Microsoft Azure data centers — certified as compliant with the following ISO standards: ISO 27001:2013, ISO 27017:2015, and ISO 27018:2019, ISO 27701:2020.

SOC 2 Type II — Data Center:

Microsoft Azure data centers are certified with SOC 2 Type 2 Security, Confidentiality, Availability, and Privacy Trust Principles.

Physical Access Control – Data Center:

For more information, please navigate to the following link that further describes Microsoft’s security around the Azure Infrastructure.

https://docs.microsoft.com/en-us/azure/security/fundamentals/physical-security

Zero-trust architecture:

Zero-trust (ZT) is the term for an evolving set of cybersecurity paradigms that move defenses from static, network-based parameters to focus on users, assets, and resources.

Atera applies a zero-trust architecture (ZTA) and uses zero-trust principles to plan and build its infrastructure and workflows, so no implicit trust is granted to assets or user accounts based solely on their physical or network location.

 

THREAT MANAGEMENT

Penetration testing:

We have an independent, third-party security vendor who conducts manual penetration testing of our internal and external infrastructure and services on a quarterly basis. This manual testing is complemented by automated testing using a variety of commercially available testing tools executed monthly.

Vulnerability scanning:

Atera uses several automated scanning tools to scan for both infrastructure and application security vulnerabilities on a frequent basis. Scans are applied to every code build and prior to code mergers.

Static Application Security Testing (SAST):

Source code is regularly scanned for any vulnerabilities prior to production going live.

NamePurposeLocation
Amazon Web ServicesCloud service provider, cloud hosting, and content delivery networkUS
FullStoryProviding optimized client experience visibilityUS
GoingEZCustomer supportRomania
HotjarProduct experience insightsMalta
MicrosoftCloud service provider, cloud hosting, and content delivery networkUS