Native cloud-based service
SabeeApp has been developed to be cloud-based, which has many positive aspects. All you need is an internet connection, a web browser, and an active SabeeApp account.
SabeeApp cannot be installed on a computer, so certain functions and services work differently from old on-premise software. The software does not run on a physical server but on AWS (Amazon Web Services) cloud infrastructure, a SaaS (Software as a Service) platform detailed below.
Multi-tenant infrastructure
SabeeApp uses a so-called shared database and code base — in other words, it facilitates a multi-tenant infrastructure. This means more customers are connected to one database, and all of our customers use the same code base and type of installation. One of the main advantages is that every customer is using the most up-to-date version of the software.
This structure does not compromise security in any way. We also use different user permissions in SabeeApp, and in a shared multi-tenant system a customer can be identified as a different user account.
Infrastructure
SabeeApp is facilitated by the cloud system of AWS (Amazon Web Services) in their Amazon data centre in Ireland. All services used by AWS are based on multi-zones, so if one zone is out of order, the rest of the system can take over.
Third-party service providers
- Beanstalk (svn, git) — source code sharing
- GitHub — source code sharing
- Google Analytics — for analysis purposes
- Twilio — text message provider
- Mandrillapp, Mailchimp — emailing service
Technical stack
At SabeeApp we use the following programming languages and frameworks: PHP, JavaScript and Bootstrap. Development runs through three separate stages:
- Development — development stage, not available externally
- Test — testing stage, available externally only for SabeeApp internal use
- Production — live stage
Database security, data security, disaster recovery
As it is a cloud-based system, data loss can occur if a fault or problem is related to the database or the file system where PDFs and other documents are stored. The following protocols and solutions are in place to minimise that risk.
- Real-life data is stored in multiple databases due to a continuously replicated database.
- Every night a security copy is made, which can be restored in minutes, from which we store the last 9 copies.
- Between the RDS and EC2 machines the communication is through an encrypted channel.
- The database can only be reached from the internal system, or through the SSH system by connecting to the main server.
- Sensitive data in the database is stored with different encryption, for example, credit cards with 2-key encryption and passwords with salted SHA-512 encryption.
- The database is divided into three zones, and if one zone is out of order, another zone will take over automatically.
Incident management procedure
At SabeeApp, every incident is solved by following a strict protocol and is then documented. This protocol is available to every SabeeApp employee for internal use.
- Identifying the problem
- Communicating the problem to the whole SabeeApp team
- Naming the incident coordinator, if necessary
- Communicating the problem to the customer, if the incident is related to a customer
- Eliminating the problem
- Avoiding re-occurrence — checking and changing the protocol if necessary
- Recovering data and source code if needed
- Making scripts and running them if replacement or modification of data is needed
- Informing technical partners if necessary
- Informing customers about the resolution of the incident
- Documenting the incident
Infrastructure security
Due to the AWS cloud system, administration, updating and server security are the responsibility of Amazon engineers. The attacking surface is minimised as much as possible thanks to their large engineering and security team.
Login credentials to AWS are only given to colleagues for a good reason, and they are only allowed to use them with strict security measures — a strict password policy and MFA.
- With the help of a third party, we regularly run black and grey box penetration tests to identify the system's vulnerabilities.
- We regularly analyse code security and quality with the SonarQube tool.
- All data traffic is encrypted with at least TLS 1.2, and every piece of data we store is encrypted.
- All passwords stored by SabeeApp are hashed — we never store any password or secret data as text.
- Logging of internal system performance is multi-level.
People security management
- Every colleague's employment contract contains information about data handling and an agreement of secret-keeping duty. Every new colleague's training includes data protection and security training.
- Connectivity to AWS is only provided for a good reason and where it is necessary for the work.
- Our engineers have reading rights only to our live database.
- For internal use and wherever possible we only use high-security passwords managed by 1Password, with MFA identification where possible.
- Our colleagues regularly attend security and data security training.
Facility companies
The SabeeApp group is facilitated by the following legal entities.
Certifications
- PCI-DSS Level 1 AOC
- NTAK certification
- VIZA certification
