Skip to main content

Security

Security is fundamental to everything we do at Mamentis. This document outlines our comprehensive security measures and best practices to protect your data, privacy, and intellectual property.

Security Framework​

Defense in Depth​

Our security strategy employs multiple layers of protection:

  • Perimeter Security: Firewalls, DDoS protection, intrusion detection
  • Network Security: VPNs, network segmentation, traffic encryption
  • Application Security: Secure coding, input validation, output encoding
  • Data Security: Encryption, access controls, data loss prevention
  • Identity Security: Multi-factor authentication, identity management
  • Physical Security: Secure data centers, access controls, monitoring

Compliance Standards​

We maintain compliance with industry-leading security standards:

  • SOC 2 Type II: Annual third-party security audits
  • ISO 27001: International security management standards
  • GDPR: European Union data protection regulation
  • CCPA: California Consumer Privacy Act compliance
  • HIPAA: Healthcare data protection (Enterprise tier)
  • FedRAMP: US government cloud security standards (upcoming)

Data Protection​

Encryption​

All data is protected with enterprise-grade encryption:

Data at Rest: AES-256 encryption
Data in Transit: TLS 1.3 with perfect forward secrecy
Key Management: Hardware Security Modules (HSMs)
Key Rotation: Automatic quarterly rotation

Data Classification​

We classify data based on sensitivity levels:

  • Public: Marketing materials, public documentation
  • Internal: Business processes, internal communications
  • Confidential: Customer data, financial information
  • Restricted: Personal data, proprietary algorithms

Data Residency​

Choose where your data is processed and stored:

  • Geographic Controls: Select specific regions for data processing
  • Data Sovereignty: Comply with local data residency requirements
  • Cross-Border Transfers: Appropriate safeguards for international transfers
  • Customer Control: You maintain control over data location

Access Controls​

Identity and Access Management​

  • Single Sign-On (SSO): Integration with enterprise identity providers
  • Multi-Factor Authentication: Required for all administrative access
  • Role-Based Access: Granular permissions based on job functions
  • Principle of Least Privilege: Minimum necessary access rights

API Security​

  • Authentication: API key and OAuth 2.0 authentication
  • Authorization: Fine-grained permission controls
  • Rate Limiting: Protection against abuse and DoS attacks
  • Input Validation: Comprehensive input sanitization

Monitoring and Logging​

  • Activity Logging: Comprehensive audit trails
  • Real-time Monitoring: 24/7 security monitoring
  • Anomaly Detection: AI-powered threat detection
  • Incident Response: Automated and manual response procedures

Infrastructure Security​

Cloud Security​

Built on secure cloud foundations:

  • AWS Security: Leveraging AWS security services and best practices
  • Network Isolation: VPC isolation and security groups
  • Container Security: Secure container images and runtime protection
  • Secrets Management: Secure storage and rotation of credentials

DevSecOps​

Security integrated throughout development:

  • Secure Development: Security training for all developers
  • Code Reviews: Security-focused code review process
  • Static Analysis: Automated security vulnerability scanning
  • Dependency Scanning: Third-party library vulnerability detection
  • Penetration Testing: Regular security assessments

Privacy Protection​

Data Minimization​

  • Collection Limitation: Only collect necessary data
  • Purpose Limitation: Use data only for stated purposes
  • Retention Limits: Automatic deletion of unnecessary data
  • Anonymization: Remove personal identifiers when possible

User Rights​

Under GDPR and other privacy laws, users have rights to:

  • Access: Request copies of personal data
  • Rectification: Correct inaccurate information
  • Erasure: Request deletion of personal data
  • Portability: Export data in machine-readable format
  • Objection: Opt-out of certain data processing

Privacy by Design​

  • Proactive Protection: Built-in privacy from the start
  • Default Settings: Privacy-friendly default configurations
  • Transparency: Clear communication about data practices
  • User Control: Granular privacy controls and settings

Incident Response​

Incident Classification​

Severity 1 (Critical)

  • Data breaches affecting personal information
  • System compromises with potential data access
  • Large-scale service outages with security implications

Severity 2 (High)

  • Attempted unauthorized access
  • Malware detection
  • Significant security control failures

Severity 3 (Medium)

  • Security policy violations
  • Suspicious activity detection
  • Minor security control failures

Response Process​

  1. Detection: Automated monitoring and manual reporting
  2. Assessment: Determine scope and impact
  3. Containment: Isolate affected systems
  4. Eradication: Remove threats and vulnerabilities
  5. Recovery: Restore normal operations
  6. Lessons Learned: Improve security measures

Communication​

  • Internal Notification: Immediate team and management alerts
  • Customer Notification: Transparent communication within 72 hours
  • Regulatory Reporting: Compliance with legal requirements
  • Public Disclosure: When appropriate and required

Security Best Practices​

For Users​

  • Strong Passwords: Use unique, complex passwords
  • Multi-Factor Authentication: Enable MFA on all accounts
  • Regular Updates: Keep software and browsers updated
  • Phishing Awareness: Be cautious of suspicious emails and links
  • Secure Networks: Avoid public Wi-Fi for sensitive operations

For Partners​

  • Security Training: Complete required security training
  • Secure Development: Follow secure coding practices
  • Access Management: Regularly review and update access permissions
  • Incident Reporting: Report security concerns immediately
  • Compliance: Maintain compliance with security requirements

For Enterprises​

  • Security Policies: Implement comprehensive security policies
  • Employee Training: Regular security awareness training
  • Third-Party Risk: Assess security of vendors and partners
  • Backup and Recovery: Maintain secure backup procedures
  • Business Continuity: Plan for security incident recovery

Security Resources​

Training and Awareness​

  • Security Training: Mandatory training for all users
  • Phishing Simulations: Regular phishing awareness tests
  • Security Updates: Regular communication of security news
  • Best Practices: Ongoing guidance and recommendations

Documentation​

  • Security Policies: Comprehensive policy documentation
  • Procedures: Step-by-step security procedures
  • Guidelines: Best practice recommendations
  • FAQs: Common security questions and answers

Support​

Continuous Improvement​

Security Reviews​

  • Regular Assessments: Quarterly security reviews
  • Penetration Testing: Annual third-party testing
  • Vulnerability Scanning: Continuous automated scanning
  • Security Audits: Independent security assessments

Technology Updates​

  • Security Patches: Timely application of security updates
  • Technology Refresh: Regular updating of security technologies
  • Threat Intelligence: Integration of latest threat information
  • Security Research: Investment in security innovation

Our security program is continuously evolving to address emerging threats and maintain the highest levels of protection for our customers, partners, and platform. We welcome feedback and collaboration to further strengthen our security posture.