Avature Security
At Avature, we implement a security-in-depth approach across our entire organization, combining advanced technical measures with robust organizational controls. While you retain full control over your data, we ensure that all processing is carried out using state-of-the-art security practices.
Physical Security
Our data centers are high-security facilities monitored by security personnel 24/7. They have perimeter fencing, video surveillance and controlled access to multiple security zones. Every data center has ISO or SOC certifications attesting to their controls.
Network Security
Avature’s networks are safeguarded through a combination of robust policies, procedures, and industry-leading technical standards. We employ layered perimeter defenses paired with advanced threat detection to secure every endpoint within the Avature cloud.
Our gateways are protected by sophisticated application firewalls, specifically designed to mitigate denial-of-service attacks. To maintain a secure perimeter, we conduct automated weekly vulnerability scans and promptly address any findings. Additionally, we commission biannual penetration tests performed by a PCI-certified third party to ensure comprehensive security assessments.
To protect your data, we encrypt all information in transit using strong, industry-standard encryption protocols, ensuring its confidentiality and integrity.
Application Security
At Avature, application security is foundational to our platform, combining cutting-edge technologies and rigorous practices to protect your data and ensure reliable performance.
Authentication
Avature supports both single sign-on (SAML) and multi-factor authentication (MFA). The platform also supports IP whitelisting and the use of hardware-based certificates. Privileged users can set password length, complexity and expiration, as well as inactive-user session timeout and lockout rules. All login attempts are logged, and privileged users can terminate any session in real time.
Role-Based Access Control
Customers can segment users by specific roles and permissions and access to data can be limited using groups and sharing features.
Encryption
Full-disk and field-specific encryption for sensitive data ensure robust protection, delivering a secure and reliable application security experience for our customers.
Journaling
Avature’s in-application journal logs all user activities, including login history, login attempts, changes in record data, workflow configuration and security settings.
Built-in Security Testing
Each Avature release is subjected to over 10,000 tests, including against the top 10 OWASP threats, alongside a complete set of performance benchmark tests.
Periodic Third-Party Testing
A Payment Card Industry (PCI) certified third-party security company performs a biannual penetration test for our application, mobile app and network, and the results are made available to customers.
Customer Testing
At Avature, customers can conduct their own application vulnerability tests on a copy of their configured instance in a quarantined environment. The data in this instance can be obfuscated so that customers can use third parties to perform the testing.
