EventIQ employs robust physical, administrative, and technical measures in alignment with industry benchmarks. Our primary goal is to ensure the confidentiality, integrity, and security of our customers' data, guarding against threats, unauthorized access, and unlawful activities. We’ve established and continually maintain a robust network firewall to shield data, regularly conducting system and software updates, including patches, fixes, and other necessary modifications. All Customer Information remains securely behind our defenses, and state-of-the-art anti-malware software ensures that threats from viruses, spyware, and other harmful entities are countered. Furthermore, data at rest and in transit are encrypted, echoing the best practices in the industry. Routine security tests confirm the robustness of our systems against this Security Policy’s criteria.

Our emphasis on access control is paramount. Unique IDs are assigned to each individual granted access, and only those essential to the Permitted Purpose can access Customer’s Information. We maintain strict password protocols, ensuring the use of strong combinations, regular updates, and prompt response to potential breaches. We always keep Customer’s Information segregated from other data, and diligent monitoring of access logs identifies any unusual activities.

EventIQ’s organizational policy maintains a comprehensive information and network security blueprint encompassing employees, subcontractors, and suppliers. Regular checks ensure adherence to our established guidelines, and without the customer’s explicit written consent, EventIQ will not delegate or subcontract obligations under this Security Policy. Our protocols for external access to our systems require multi-factor authentication, offering an added layer of security, showcasing our unwavering commitment to safeguarding Controller Information and upholding the highest standards of data security.

Our security assessment schedule involves a combination of automated security scans, manual vulnerability assessments, and penetration testing. These assessments are conducted on a quarterly basis, which allows us to maintain a proactive and vigilant stance against emerging security threats.

Furthermore, in addition to these quarterly assessments, we perform immediate assessments in response to significant changes in our infrastructure, such as major updates or system changes.

Due to varying requirements for each customer and to have greater control of the environment, resources, and configurations, each customer’s data is completely isolated in a dedicated cloud account.

Access to EventIQ’s infrastructure is tightly controlled and granted only to authorized individuals based on their roles and responsibilities. The access is governed by the principle of least privilege, which means that individuals are granted the minimum level of access necessary to perform their specific tasks. The specific staff members who are granted access to the infrastructure can vary based on their roles and the needs of the organization.

Access to infrastructure is determined by job roles and responsibilities. Only staff members who require access to perform their duties are granted permission. Access controls, such as user accounts, passwords, and multi-factor authentication (MFA), are enforced to ensure only authorized individuals can access infrastructure resources. Access permissions are regularly reviewed to ensure they remain appropriate and necessary. Any unnecessary or outdated access is promptly revoked. Access to infrastructure is continuously monitored and logged. Audit trails are maintained to track who accessed what and when. Access is promptly revoked when staff members change roles, leave the organization, or when access is no longer required.

Yes, data is adequately secured when at rest within our systems. We employ a combination of encryption, access controls, and security best practices to ensure the confidentiality and integrity of data stored within our infrastructure.

EventIQ uses tools like Inspector to find software vulnerabilities and unintended network exposure in real-time on our application servers, which helps in reducing the mean time to remediate any vulnerabilities.

We also leverage AWS Shield Standard and WAF to protect the systems from SQL injection attacks, cross-site scripting, and to enforce any other boundary restrictions within which the system should operate.

Vulnerability Assessments: The platform undergoes regular vulnerability assessments and penetration testing. These tests help identify and remediate security weaknesses, ensuring that the system remains resilient against potential threats.