uStudio’s Statement on Security
Introduction
We use uStudio software every day to communicate essential information to our employees, clients, customers and partners. Ensuring our platform remains secure is vital to protecting our own data, and protecting your information is our highest priority. Our security strategy covers all aspects of our business, including:
- uStudio’s corporate security policies
- Physical and environmental security
- Operational security processes
- Scalability & reliability of our system architecture
- Data model access control in uStudio
- Systems development and maintenance
- Service development and maintenance
- Regularly working with third party security experts
uStudio Corporate Security Policies & Procedures
Every uStudio employee signs a Data Access Policy that binds them to the terms of our data confidentiality policies, available at uStudio.com/terms and uStudio.com/privacy. Access rights are based on employee’s job function and role.
Security in our Software Development Lifecycle
uStudio uses the git revision control system. Changes to uStudio’s code base go through a suite of automated tests and are reviewed and go through a round of manual review. When code changes pass the automated testing system, the changes are first pushed to a staging server wherein uStudio employees are able to test changes before an eventual push to production servers and our customer base. We also add a specific security review for particularly sensitive changes and features. uStudio engineers also have the ability to “cherry pick” critical updates and push them immediately to production servers based upon the approval path above. uStudio also has the capability of rolling back seamlessly to prior service versions should a platform update introduce a critical security vulnerability.
In addition to a list where all access control changes are published, we have a suite of automated tests that verify our platform security is working as designed. We also work with third-party security professionals to:
- Test our code for common exploits
- Use network scanning tools against our production servers
Security at the uStudio office
As a cloud-native company, uStudio treats all networks as “untrusted”, including our own office networks. This means that we do not allow any traffic to bypass our infrastructure security, to directly access servers or assets, etc. simply because the traffic originates from a uStudio-managed site.
Secondly, we monitor traffic on our office networks for malicious activity and retain appropriate logs from networking devices for auditing purposes.
uStudio Architecture & Scalability
Scalability/Reliability of Architecture
uStudio uses Google Cloud, AWS, and Rackspace to host our database instances where user data is stored. The database is replicated at regular intervals so that we can quickly recover from a database failure. As an extra precaution, we take snapshots of the databases and securely move them to a separate data center so that we can restore them elsewhere as needed, even in the event of a regional Google, etc. failure.
We currently host data in secure SSAE 16 audited data centers in the United States.
Encrypted Transactions
Connections between hosts use TLS 1.2 wherever possible. Web connections to the uStudio service are via TLS 1.0 and above, with TLS 1.0 support deprecated and intended to be removed by the PCI end of life date of June 30th, 2018. We support forward secrecy and AES-GCM, and prohibit insecure connections using SSL3 and below or RC4. Many of our services already have removed support for TLS 1.0 and even TLS 1.1 in certain cases.
Getting Ready for the GDPR with uStudio
The General Data Protection Regulation (“GDPR”) is a new law establishing protections for the personal data of EU residents. When the GDPR comes into force on May 25, 2018, most organizations that collect, maintain, or process EU residents’ personal data (regardless of the organization’s global location) will be required to implement certain procedures and safeguards for that data. In preparation for the GDPR, uStudio has established a comprehensive compliance program and is committed to partnering with its customers and vendors to help them in their GDPR compliance efforts. Below, we explain how uStudio is preparing for the GDPR and how customers can use uStudio to support their GDPR compliance initiatives.
Data Processing Agreements
Under the GDPR, “data controllers” (i.e. entities that determine the purposes and means of processing data) are required to enter into agreements with other entities that process data on their behalf (called “data processors”). uStudio offers its EU customers who are data controllers the option to enter into a robust data processing agreement that requires uStudio to safeguard personal data in accordance with GDPR requirements.
International Data Transfers
Consistent with existing EU data protection laws, the GDPR requires organizations to use a recognized legal mechanism to transfer data from the EU to other countries that do not have a similar data protection framework, including the United States. Additionally, uStudio offers customers located in the EU the option to enter into EU Model Contractual Clauses with us upon request.
Data Access, Management, and Portability Tools
The GDPR gives individual data subjects in certain circumstances the rights to, among other things, access, delete, and make corrections to their data. Data subjects can make these requests directly to the data controllers of their information. With uStudio, it’s easy for our customers who are data controllers to access and manage their team members’ data in response to these requests. For example, customers can directly access, update, modify, and delete data within the uStudio platform. uStudio also offers customers the ability to export organization member and guest information so that it can be sent outside of the platform.
Privacy Documentation
At its core, the GDPR is focused on transparency, fairness, and accountability. Accordingly, the law requires organizations to maintain documentation about their privacy practices and their decisions about how they handle individuals’ personal data. uStudio shares the GDPR’s commitment to these principles, and has included within its ongoing GDPR compliance program documentation about uStudio’s data collection and processing activities, and the various policies and guidelines it follows pursuant to the GDPR.
Security
Securing our users’ personal data continues to be a priority for uStudio as we prepare for the GDPR. The GDPR requires organizations to use appropriate technical and organizational measures to protect the security, confidentiality, and integrity of personal data. uStudio has implemented a variety of safeguards to protect the security of our platform, including encrypting web connections to protect data transmissions, replicating our databases to support reliability of the platform, and controlling access to our facilities and office network. uStudio also offers customers the ability to use additional security controls to further enhance the security of their teams’ data.
Ongoing Communication
We value communication with our customers. As uStudio continues to evaluate and update its data protection program, we will keep you posted with important updates.
uStudio Information Security
Security Consulting and Application Review
We work with external security advisors, and maintain an external bounty program where we pay security researchers who discover vulnerabilities.
Data Center Security
uStudio uses infrastructure across Google, Amazon, Rackspace and Heroku.
Google
Google employs a robust physical security program with multiple certifications, including an SSAE 16 certification. For more information on Google’s physical security processes, please visit https://cloud.google.com/security/compliance/soc-2/.
Amazon
Amazon employs a robust physical security program with multiple certifications, including an SSAE 16 certification. For more information on Amazon’s physical security processes, please visit aws.amazon.com/security.
Rackspace
Rackspace employs a robust physical security program with multiple certifications, including an SSAE 16 certification. For more information on Amazon’s physical security processes, please visit https://community.rackspace.com/products/f/public-cloud-forum/7777/security-compliance-with-data-in-rackspace-cloud.
Heroku
Heroku’s physical infrastructure is hosted and managed within Amazon’s secure data centers and utilize the Amazon Web Service (AWS) technology. Amazon continually manages risk and undergoes recurring assessments to ensure compliance with industry standards. Amazon’s data center operations have been accredited under:
- >ISO 27001
- SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II)
Product Features
Administrator Management Features
- Authentication – uStudio administrators create unique logins to access the uStudio platform. Passwords are stored directly with uStudio, where we secure them using salted hashes.
- User Management – Administrators can see user information (such as name and email) and can remove members from studios.
User Features
- Privacy, Visibility, & Sharing Settings – Customers determine who can access different categories of data like studios, videos, and assets. Access to a uStudio organization (and dependent resources) is based on invitations sent by a Studio owner.
Penetration Testing and Vulnerability Assessments
Third party security testing of the uStudio application is performed by independent and reputable security consulting firms. Findings from each assessment are reviewed with the assessors, risk ranked, and assigned to the responsible team.
Privacy
Privacy Policy
uStudio’s privacy policy, which describes how we handle data input into uStudio, can be found at uStudio.com/privacy.
Safe Harbor compliance
uStudio complies with the EU-U.S. and Swiss-U.S. Safe Harbor (“Safe Harbor”) frameworks and principles.
Data Security
Customer Applications
uStudio employs service-oriented architecture to ensure areas of the system (and related data) are isolated from each other. Our legacy services use a combination of virtualized “stateless” servers inside automatically scaling private networks, and our modern services are based on Kubernetes and Docker / LXC containers to ensure each process is independent and isolated. This restrictive operating environment is designed to prevent security and stability issues.
uStudio Database
Customer data is stored in separate access-controlled database instances per application or service. Each database instance requires unique credentials that are only valid for the service-specific data and are only issued to a single application or service.
Customer data can be accessed via authenticated user API calls or using the user interface provided by uStudio.
User data stored in our databases is encrypted at rest and in transit via AES-128 or higher. Asset files are managed independently, are encrypted in transit, and can be encrypted at rest based on specific customer requirements.
System Security
System Configuration
System configuration and consistency is maintained through standard, up-to-date images, configuration management software, and by replacing systems with updated deployments. Systems are deployed using up-to-date images that are updated with configuration changes and security updates before deployment. During deployment, existing systems are decommissioned and replaced with up-to-date systems. Finally, uStudio designs our service infrastructure to be largely stateless, ensuring that each instance can be discarded or replaced at any moment.
System Authentication
All access to underlying service hosts is tied to SSH keys issued individually for each deployment engineer. Password-based authentication is specifically not supported in order to prevent password brute force attacks, theft, and sharing.
Customer Security Best Practices
Encrypt Data in Transit
Enable HTTPS for applications and SSL/TLS database connections to protect sensitive data transmitted to and from applications.
Encrypt Sensitive Data at Rest
Sensitive customer data is encrypted at rest and in transit using industry standard encryption and best practices.
Availability
We are committed to making uStudio consistently available to you and your teams. Our systems have built-in redundancy to withstand failures and are constantly monitored to keep your work uninterrupted.
Want to report a security concern?
We offer a Security Exploit Bounty Program. Email us at security@ustudiostage.wpengine.com.