1.Oversigt og Omfang
Denne Sikkerhedseksponering beskriver BambooHRs tekniske og organisatoriske sikkerhedsforanstaltninger ("Security Measures"), der er designet til at beskytte Kunde-data mod uautoriseret adgang, videregivelse, ændring og sletning. Denne udstilling indgår som en del af og udgør en del af BambooHR Data Processing Agreement.
BambooHR er certificeret under SOC 2 Type II-frameworket (AICPA Trust Services Criteria for Security, Availability, and Confidentiality) og gennemgår årlige tredjepartsrevisioner for at verificere designet og den opererende effekt af disse kontroller. Kunder kan anmode om en kopi af BambooHRs seneste SOC 2-rapport under NDA ved at kontakte vores sikkerhedsteam via vores kontaktside.
2.Infrastruktur- og netværkssikkerhed
BambooHRs produktionsinfrastruktur er vært hos Amazon Web Services (AWS) i USA, med data replikeret til flere tilgængelighedszoner for redundans. Alle produktionssystemer er isoleret i et Virtual Private Cloud (VPC) med strenge netværksadgangscontrolls. BambooHR anvender firewalls, indtræden-detektion-systemer og webapplikations-firewalls for at beskytte mod uautoriseret adgang og almindelige webbaserede angreb.
BambooHR anvender en forsvarets dybde-tilgang til netværkssikkerhed, herunder netværkssegmentering mellem produktions-, staging- og udviklingsmiljøer; automatiseret sårbarhedsscanning af infrastrukturkomponenter; og kontinuerlig overvågning af netværkstrafik for unormal aktivitet.
3.Databeskyttelse og kryptering
All Customer Data is encrypted in transit using TLS 1.2 or higher. All Customer Data at rest is encrypted using AES-256 encryption. Database encryption keys are managed using AWS Key Management Service (KMS) with strict access controls and rotation policies.
Kunde-data er logisk adskilt fra data tilhørende andre kunder gennem applikations- og databasekontroller. BambooHR gennemfører regelmæssige dataklassificeringsøvelser for at identificere og anvende passende sikkerhedskontroller på forskellige datakategorier.
4.Applikationssikkerhed
BambooHR follows a secure software development lifecycle (SSDLC) that includes security requirements definition, threat modelling, code review for security vulnerabilities, and security testing. All code changes are reviewed by at least one engineer before deployment, and changes are subject to automated security scanning.
BambooHR conducts annual penetration testing performed by an independent third-party security firm. Critical and high-severity findings are remediated within defined SLAs. BambooHR also operates a vulnerability disclosure programme that allows external researchers to report potential security issues.
5.Adgangskontroller og godkendelse
Access to production systems is restricted to authorised BambooHR personnel on a need-to-know, least-privilege basis. All access to production environments requires multi-factor authentication (MFA) and is logged and audited. Privileged access is reviewed quarterly and revoked immediately upon employee termination.
Kunder kan konfigurere multifaktorautentificering, single sign-on (SSO) og rollebaserede adgangskontroller (RBAC) inden for deres BambooHR-konti. BambooHR understøtter SAML 2.0-baseret SSO-integration med store identitetsudbydere, herunder Okta, Azure AD og Google Workspace.
6.Hændelsesdetektion og respons
BambooHR opretholder en dokumenteret Security Incident Response Plan, der definerer procedurer til detektion, klassificering, inddæmpning, undersøgelse og recovery fra sikkerhedshændelser. Hændelsesrespons-teamet omfatter repræsentanter fra sikkerhed, ingeniørtjenester, juridisk og kundesupportfunktioner.
BambooHR uses a combination of automated alerting and 24/7 on-call security monitoring to detect potential security incidents. Upon confirming a security incident affecting Customer Data, BambooHR will notify affected customers within seventy-two (72) hours as required by applicable law and the Data Processing Agreement.
7.Forretningskontinuitet og katastrofeberedskab
BambooHR opretholder en Business Continuity Plan (BCP) og Disaster Recovery Plan (DRP), som bliver testet mindst årligt. BambooHR sigter mod et Recovery Time Objective (RTO) på fire (4) timer og et Recovery Point Objective (RPO) på én (1) time for sine kerneplatformtjenester.
Kunde-data bliver hele tiden sikkerhedskopieret ved hjælp af point-in-time- recovery og daglige snapshots, der opbevares i tretti (30) dage. Sikkerhedskopieringsintegritet testes regelmæssigt for at sikre, at data kan gendannes i en recoverysituation.
8.Employee Security and Training
All BambooHR employees with access to production systems or Customer Data undergo background checks prior to employment and sign confidentiality agreements. All employees complete mandatory security awareness training upon hire and annually thereafter, covering topics including phishing awareness, password hygiene, and data handling responsibilities.
BambooHR has a documented acceptable use policy for employees and contractors that prohibits use of BambooHR systems for personal activities and unauthorized data access. Violations are subject to disciplinary action up to and including termination.
