1.概览与范围
本安全展览描述 BambooHR 针对保护客户数据免遭未授权访问、披露、改动和毁坏的技术与组织安全措施（“安全措施”）。本展览被并入并构成本 BambooHR 数据处理协议的一部分。
BambooHR 已通过 SOC 2 Type II 框架（AICPA 信任服务安全性、可用性与保密性标准）认证，并每年进行第三方审计以验证这些控制设计与运行有效性。客户可通过联系我们的安全团队，在 NDA 下请求获取 BambooHR 最近的 SOC 2 报告副本。
2.基础设施与网络安全
BambooHR 的生产基础设施托管于美国的 Amazon Web Services（AWS），数据为冗余地 replicated 于多个可用区。所有生产系统均在虚拟专用云（VPC）中隔离，具严格的网络访问控制。BambooHR 采用防火墙、入侵检测系统和 Web 应用防火墙以防止未授权访问及常见的基于网页的攻击。
BambooHR 采用纵深防御的网络安全方法，包括生产、预生产与开发环境之间的网络分段；对基础设施组件进行自动化漏洞扫描；持续监控网络流量以发现异常活动。
3.数据安全与加密
All Customer Data is encrypted in transit using TLS 1.2 or higher. All Customer Data at rest is encrypted using AES-256 encryption. Database encryption keys are managed using AWS Key Management Service (KMS) with strict access controls and rotation policies.
客户数据在应用层和数据库层级控制下与其他客户数据逻辑隔离。BambooHR 进行定期数据分类，以识别并对不同数据类别应用适当的安全控制。
4.应用安全
BambooHR follows a secure software development lifecycle (SSDLC) that includes security requirements definition, threat modelling, code review for security vulnerabilities, and security testing. All code changes are reviewed by at least one engineer before deployment, and changes are subject to automated security scanning.
BambooHR conducts annual penetration testing performed by an independent third-party security firm. Critical and high-severity findings are remediated within defined SLAs. BambooHR also operates a vulnerability disclosure programme that allows external researchers to report potential security issues.
5.访问控制与身份验证
Access to production systems is restricted to authorised BambooHR personnel on a need-to-know, least-privilege basis. All access to production environments requires multi-factor authentication (MFA) and is logged and audited. Privileged access is reviewed quarterly and revoked immediately upon employee termination.
客户可在其 BambooHR 账户中配置多因素认证、单点登录（SSO）以及基于角色的访问控制（RBAC）。BambooHR 支持基于 SAML 2.0 的 SSO 集成，与 Okta、Azure AD、Google Workspace 等主流身份提供者兼容。
6.事件检测与响应
BambooHR 维护有文档化的安全事件响应计划，定义检测、分类、遏制、调查和从安全事件中恢复的程序。事件响应团队包括来自安全、工程、法律和客户支持等职能的代表。
BambooHR uses a combination of automated alerting and 24/7 on-call security monitoring to detect potential security incidents. Upon confirming a security incident affecting Customer Data, BambooHR will notify affected customers within seventy-two (72) hours as required by applicable law and the Data Processing Agreement.
7.业务连续性与灾难恢复
BambooHR 维护业务连续性计划（BCP）和灾难恢复计划（DRP），并至少每年进行一次测试。BambooHR 的核心平台服务目标为恢复时间目标（RTO）4 小时，恢复点目标（RPO）1 小时。
客户数据通过持续备份实现点时间还原和每日快照，保留期为三十（30）天。定期测试备份完整性，以确保在恢复场景下能够成功还原数据。
8.Employee Security and Training
All BambooHR employees with access to production systems or Customer Data undergo background checks prior to employment and sign confidentiality agreements. All employees complete mandatory security awareness training upon hire and annually thereafter, covering topics including phishing awareness, password hygiene, and data handling responsibilities.
BambooHR has a documented acceptable use policy for employees and contractors that prohibits use of BambooHR systems for personal activities and unauthorized data access. Violations are subject to disciplinary action up to and including termination.
