Security

Security is in our DNA.

Your compliance program holds sensitive details about your business. Here is how we host, encrypt, and protect them, and how we keep LakeRidge itself secure.

Report a vulnerability

Encryption
AES-256
Your data, encrypted at rest and in transit with FIPS-compliant modules.
Sign-in
MFA
Multi-factor authentication on every login, over TLS 1.2 or higher.
Backups
Daily
Full backups every day, with restores tested every two weeks.
Hosting
AWS
US East data centers, FedRAMP authorized and ISO 27001 certified.

Application security

How we protect your data in LakeRidge.

Where your data lives, how it’s encrypted, who can see it, and how we keep it safe for as long as you’re with us.

  • Hosted on AWS

    LakeRidge apps run in Amazon Web Services (AWS) US East, which holds a FedRAMP Joint Authorization Board provisional authorization (JAB P-ATO) and multiple agency authorizations at the moderate impact level. Amazon manages risk continuously and goes through recurring assessments against industry standards.

    Amazon data center accreditations

    • FedRAMP Moderate
    • ISO 27001
    • SOC 1
    • SOC 2
    • PCI DSS Level 1
    • FISMA Moderate

  • Encrypted at rest and in transit

    All data LakeRidge processes, stores, or transmits is encrypted with Federal Information Processing Standards (FIPS) compliant algorithms, and every encryption module we use is FIPS compliant. Data in transit is protected with AES-256 and SHA-256, and data at rest with 256-bit AES encryption.

  • Who can see your data

    Only LakeRidge technical staff with a need to know can see your data, such as assessment answers, file uploads, and anything else you enter. We separate duties and grant access strictly on a need-to-know basis. Passwords are stored as one-way hashes, so not even our staff can view them. A lost password can’t be retrieved, only reset.

  • Secure development

    We build to security best practices, including the OWASP Top 10 and SANS Top 25, and version control all code in git. On top of automated tests and third-party automated security audits, every change is manually tested and reviewed for bugs and vulnerabilities before it reaches staging or production. Databases are kept separate and dedicated, which prevents corruption and overlap, and our certified security staff run penetration tests against LakeRidge apps.

  • Protected logins

    Every login is protected with multi-factor authentication, and login pages only send data over TLS 1.2 or higher. Passwords must be at least 10 characters and meet complexity rules. We suspend accounts that show irregular or suspicious login activity. You choose each user’s level of access, and multiple layers of logic keep accounts separate from each other.

  • Tested backups

    Incremental backups let us roll back to the exact second, up to 4 days back. We also take a full backup of every database each day and test restores every two weeks. Backups are stored in the same accredited Amazon data centers.

  • If you unsubscribe

    When you end your subscription, all of the data you entered into LakeRidge is deleted from our databases within one year.

  • Maintenance outside business hours

    Planned maintenance happens outside regular U.S. business hours: 9:00 AM to 5:00 PM Eastern, Monday through Friday, excluding federal holidays. If unplanned maintenance is ever needed, we reach out to customers directly.

Corporate security

How we run security inside LakeRidge.

We hold ourselves to the same standard we help our customers meet.

  • Internal IT security

    LakeRidge follows the NIST SP 800-171 security practices, with a documented security plan and a tracked plan of action for any gaps. The practices cover access control, incident response, audit logging, risk management, and more.

  • Trained, vetted people

    Every employee is trained on security best practices, including how to spot social engineering, phishing scams, and hackers. Team members with access to customer data, such as tech support and engineering, pass criminal background checks before they’re hired. Every employee signs an acceptable use and privacy agreement.

Responsible disclosure

Found a vulnerability? Tell us first.

If you’ve discovered a security or privacy vulnerability in a LakeRidge application, please don’t share it publicly. Email our security team instead.

security@lakeridge.io

What to include

  1. The product or service you believe is affected.
  2. What you observed, and what you expected to happen.
  3. A numbered list of steps to reproduce the issue.
  4. A video demonstration, if the steps may be hard to follow.

See LakeRidge in action.

Talk with our team about your framework, your gaps, and the right plan.

Get a demo

See LakeRidge in action.

Loading the booking calendar…