Security (PSA)

Data Storage And Security

Enable HTTP strict transport security (HSTS)

Enabling Reference Tokens

Enabling Secure Cookies in the Web Application

Http to Https redirect in web app

Protect token signing keys with a certificate

Read-only connection for reports

Security Management and Architecture

The article provides security documentation for Halo, addressing common questions about processes, data encryption, and compliance. Backup data is retained in various schedules, and customer data is stored in regional AWS S3 buckets, encrypted with AES-256. Halo complies with ISO 27001 and AWS standards such as SOC and PCI DSS. The release schedule includes stable and beta paths with specific upgrade and patch protocols. Rollbacks occur for critical issues, targeting a 99.95% uptime and a 4-hour recovery time. Customer systems have isolated databases but shared backend infrastructure. IP restrictions are generally not standard.

SQL Injection Security Vulnerability

SQL Injection Vulnerability Patched

Update to SAML Validation

X.509 for encryption