Troopr integrates with Slack SSO solution to provide a seamless login experience. User authentication can take place without the need to manage yet another account/password combination.

All communication between customer systems and Troopr takes place using high levels of encryption (TLS 1.2/HPPS). All stored data is encrypted at rest using AES256 encryption. This includes all types of data at rest within our systems - relational databases, file stores, database backups, etc. The encryption keys are generated and managed by AWS KMS and rotated once a year.

Enjo servers are hosted in Amazon Web Services (AWS) data centers maintained by industry-leading service providers. Data center providers offer state-of-the-art physical protection for the servers and related infrastructure that comprise the operating environment. These service providers are responsible for restricting physical access to Enjo’s systems to authorized personnel. Our hosting environment maintains multiple certifications for its data centers, including ISO 27001 compliance, FedRAMP authorization, PCI Certification, and SOC reports. For more information about their certification and compliance, please visit the AWS Security website and AWS Compliance website.

Enjo administrators can set user roles according to the principle of least privilege. Users only see what they need in order to perform their jobs.

Customer data is stored in multi-tenant datastores and assigned a unique tenant token, which prevents one customer from accessing another customer's data.

Production access is limited to a small group, and is granted through explicit signed permission. An account review is done quarterly and documented accordingly. Further Troopr's personnel (employees and independent contractors) who have direct access to Troopr's internal information systems are required to understand and follow internal policies and standards. Before gaining initial access to systems, they must agree to confidentiality terms, pass a background screening, and attend security training. This training covers privacy and security topics, including device security, acceptable use, preventing malware, physical security, data privacy, account management, and incident reporting. Upon termination of work at Troopr, all access to Troopr systems is removed immediately.

In addition to AWS, Enjo uses some third parties to perform certain components of its operations.  Only vendors who have successfully demonstrated sufficient security capabilities and commitments are authorized to support the Troopr system.

Any vendor with the potential to access sensitive client data is required to provide an external audit or, at a minimum, submit to a risk interview and demonstrate best security practices. These artifacts are refreshed annually to ensure no lapse in oversight.  Moreover, each vendor is required to sign a Data Processing Agreement and contractually commit to data security practices.

Troopr scans Enjo systems regularly to identify common vulnerabilities. Servers are patched automatically on a regular schedule, with critical and high severity patches applied with the highest priority. Additionally, Enjo leverages a built-in application security management platform (Sqreen) that uses in-app security signals to detect and block attacks. Sqreen protects Troopr application by preventing data breaches, stopping account takeovers and blocking business logic attacks.

Troopr partners with external penetration testing vendors to conduct annual tests. Medium and higher severity findings are remediated, with reports available upon request and under NDA.

Troopr runs backups for Enjo daily, encrypted in transit and at rest, with regular tests. Backups reside "off-site" from our offices, on Amazon S3 servers that store files on multiple devices. Troopr reviews and updates its Business Impact Analysis (BIA) and Business Continuity Plan (BCP) on an annual basis. Our team has developed a process to provide well-defined Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs). Reports are available upon request and under NDA.

Troopr maintains ongoing documentation and verification of its incident response policy and procedures rehearsing potential incidents twice annually. Though highly unlikely, any data breach would be communicated to a client’s Troopr administrator within 24 hours of confirmation.

Security is baked into the coding process, and OWASP 10 risk classification is performed to validate new code prior to deployment. All code is stored in a version-controlled repository with changes subject to peer review and continuous integration testing. Also, Enjo developers undergo specialized security training to address common vulnerabilities such as Cross Site Scripting and SQL injection.

Troopr hires an independent audit firm to conduct an annual SOC 2, Type II audit, which includes not only the Common Criteria, but the Confidentiality and Privacy trust services criteria too. Further Troopr conducts quarterly internal audits. Our InfoSec program follows a process of careful planning. Roles and responsibilities related to customer data protection and verification are well-defined and documented.

Troopr has an active bug bounty program and we partner with ethical hackers to find and resolve issues in our software. Submissions to our bug bounty program are evaluated and remediated based on severity. Report a vulnerability to security@troopr.io.

For any questions or additional information, please reach out to our security team at security@troopr.io