The purpose of this page is to provide transparency into the safeguards that have been implemented to protect the ProcessUnity Platform, Global Risk Exchange and our customers’ data. This summary is intended to address the most common questions that we receive from external stakeholders who are interested in the maturity and effectiveness of our security program.
Q: Does ProcessUnity have a team that is dedicated and responsible for the protection of customer data?
Yes. The ProcessUnity security team is tasked with the implementation of a comprehensive and effective risk management program that covers our enterprise corporate environment, the ProcessUnity Platform and the Global Risk Exchange.
Q: Does ProcessUnity have a dedicated security officer?
Yes. ProcessUnity has an assigned and dedicated Chief Information Security Officer (CISO) who is responsible for the ProcessUnity security program and the management of the security team.
Q: Is the ProcessUnity security program based on industry-standard security best practices and control frameworks?
Yes. The ProcessUnity security program leverages concepts and security and privacy controls from a number of global standards such as the NIST Special Publication 800 series, ISO 27001/2, OWASP, GDPR, CCPA, etc.
Q: Has ProcessUnity undergone an independent audit or certification of compliance with security standards?
Yes. On an annual basis ProcessUnity renews our SOC 2 Type 2 audit and ISO 27001:2022 certification. Note that the Global Risk Exchange is not currently included in the scope of these audits.
Q: Has ProcessUnity developed a security policy framework?
Yes. ProcessUnity has developed, and continually refines, a library of security policies, standards, and plans. These documents are accessible by all ProcessUnity staff and are included in new hire and annual training. They cover standard security domains such as: identity and access management, configuration and change management, personnel security, and incident response. Policies, standards, and plans are approved by the ProcessUnity executive leadership.
Q: What are the core elements of the ProcessUnity security program?
ProcessUnity’s security program is based on an understanding of our assets, their criticality to both ProcessUnity and our customers, the internal and external threats to those assets, and the effectiveness of our controls in response to those threats. We utilize a risk-based approach where strategic planning and the prioritization of corrective actions is based on a qualitative and quantitative understanding of risks that impact our organization and our customers.
Q: Has ProcessUnity undergone penetration testing by an independent third party?
Yes. The ProcessUnity Platform and the Global Risk Exchange each individually undergo penetration testing on an annual basis at minimum, and after significant changes.
Q: What type of internal security risk or vulnerability assessments does ProcessUnity perform?
ProcessUnity uses multiple methods and techniques to evaluate our environments for security weaknesses or vulnerabilities. These methods include, but are not limited to:
- automated, scheduled vulnerability scanning of operating systems, firmware, middleware, etc.,
- static and dynamic scanning of code repositories;
- software composition analysis scans of third-party code;
- security-focused systems testing as part of the ProcessUnity platform’s system development lifecycle (SDLC);
- manual audits/tests of security control implementation and effectiveness;
- security-focused interviews with ProcessUnity teams and individual personnel;
- annual SOC 2 Type 2 and ISO 27001 compliance audits;
- annual, at minimum, independent penetration testing; and
- ongoing updates of the ProcessUnity assessment on the Global Risk Exchange, including evidence validation by Deloitte.
Q: Are ProcessUnity employees subject to a background screening prior to being provided access to any customer data?
Yes. All employees must successfully pass a background check before finalizing the job offer and onboarding process. New hires are not given access to any ProcessUnity systems or data until the background screening process is complete.
Q: Has ProcessUnity implemented a security awareness and training program?
Yes. ProcessUnity leverages an industry-standard tool to plan, develop, execute, and track security-focused training. All new hires are required to complete training within ten business days of onboarding. All employees are required to complete annual and quarterly security training. In addition, employees may be asked to complete unscheduled training based on the outcome of internal testing (e.g. phishing campaigns) or violations of security policy. All new hires sit with a member of the security team in their first two weeks of employment to discuss basic security principles as well as specific security policies that apply to their role.
Q: Does ProcessUnity process, transmit, or store any customers’ personally identifiable information (PII)?
Yes, but this is limited to business contact information only. Specifically, we collect an individual’s name, along with their business email address and business phone number (optional).
Q: What physical security controls has ProcessUnity put in place to protect customer data?
The ProcessUnity Platform is hosted by Azure. All physical security controls directly associated with the application are inherited from Azure. For more information about Azure’s physical security program please visit: Physical security of Azure datacenters – Microsoft Azure | Microsoft Learn. ProcessUnity headquarters is located in Concord, Massachusetts. This facility is protected by safeguards that include electronic locks, badge readers, CCTV surveillance at all ingress and egress points, access logging and audits, and a centralized fire detection and suppression system.
The Global Risk Exchange is hosted by Amazon Web Services (AWS) in U.S. datacenters. All physical security controls directly associated with the platform are inherited from AWS. For more information about AWS’s physical security program please visit: https://aws.amazon.com/compliance/data-center/controls/.
Q: What authentication mechanisms are in place for users accessing the ProcessUnity application or the Global Risk Exchange?
Users of the ProcessUnity Platform and Global Risk Exchange may choose between username and password, multi-factor authentication, and single sign-on.
Q: How does ProcessUnity encrypt data in transit and at rest?
All customer data (name, business email, business phone, assessment answers, etc.) is encrypted in transit using TLS 1.2 or better. Customer data is encrypted at rest via AES-256 strength encryption.
Q: Does ProcessUnity have a policy regarding the use of removable storage media?
Yes. The use of removable media to transmit or store customer data is strictly forbidden by policy. Any exceptions to this policy must be approved by the CISO. Exceptions undergo monthly access reviews to understand if there is still a need. USB exceptions require encryption and scanning of the device before it can be used.
Q: How often does ProcessUnity backup customer data, and are data backups ever tested?
ProcessUnity performs full, daily backups of the platform’s production database. Backups are tested on a monthly basis, at minimum.
Q: Does ProcessUnity have an incident notification process in place?
Global Risk Exchange: RTO is defined as 48 hours and our RPO is 24 hours.
ProcessUnity Platform: RTO is defined as 4 hours and our RPO is 1 hour.
Q: How does ProcessUnity ensure that their application code is free of vulnerabilities or flaws?
The ProcessUnity Platform and Global Risk Exchange follow a defined system development lifecycle (SDLC). All code changes must be approved by a product manager, a peer developer, and a tester before being deployed to the production environment. The SDLC process includes submitting all updated code repositories for code vulnerability scanning. We deploy application code by using a staged deployment process. The changes are applied first in the staging environment, where they are tested, before they are applied to the demo environment for additional testing, and finally on to the production environment. In addition, the ProcessUnity Platform is dynamically scanned by our code vulnerability scanning solution and is pen tested on an annual basis, at minimum.
Q: Does ProcessUnity have an incident response program in place?
Yes. Our incident response program is documented in the ProcessUnity Incident Response Plan and a library of incident playbooks that are focused on response procedures for specific types of incidents. We utilize a suite of industry- standard tools to assist in the identification, verification, containment, analysis, and removal of threats from our computing environments.
Q: Does ProcessUnity have an incident notification process in place?
Yes. We notify any potentially affected customers within a commercially feasible timeframe, and never longer than is required by contract.
33 Bradford Steet Concord, MA 07142