Data Security, Reliability, and Privacy Overview

Uptime and Reliability

The BSD Tools are hosted in the US East region of Amazon Web Services in Northern Virginia. Servers are based in multiple availability zones, which are physically separate data centers connected only by low-latency network links, in order to provide high availability even in the event of an issue with a single availability zone. Amazon Web Services is the most widely-deployed cloud vendor and is also SOC 2 certified. More details about Amazon’s environment can be found at http://aws.amazon.com/security.

Some functionality, including the BSD Tools mass mailing infrastructure, is hosted in an Internap collocation facility near Boston. Internap is a top-rated collocation vendor with top-tier security, physical systems redundancy, and network connectivity.  Internap provides connectivity to multiple backbone providers and is well known for their performance and reliability-optimized network routing protocols.  The Internap facility is SOC 2 certified.  Information about SOC 2 certification can be found at http://www.internap.com/2012/04/03/what-is-soc2.

Both Internap and AWS have passed SAS 70 Type II audits.

Our system administrators, using a variety of automated systems, monitor Blue State Digital’s infrastructure around the clock. Our monitoring system is tuned to alert us to small problems before they turn into big ones. A system administrator and a software developer are on-call 24/7 to handle any issues that may arise.

Our team follows a procedure of daily and weekly checklists and log analysis to validate compliance with all operational policies and confirm the operability of all backup and monitoring systems.

Backups

We store data using fault tolerant systems, which are backed up locally and offsite weekly and augmented with separately stored transactional logs, which are also backed up offsite nightly. By using a combination of these backups and logs, we are capable of “point in time” recovery of any database or software in the event of a fault or malicious attack. All backups are stored using technology that provides 11 9s of durability.

Security

Our security procedures include frequent onsite and secure offsite backups, automated and human monitoring of physical and electronic access to the servers where your files are housed, and disposal of financial data (such as credit card numbers) after transactions are processed.  We are a PCI DSS-compliant Level 1 Service Provider, and we develop our software in accordance with the OWASP Top 10 guidelines for web application security.

Our contribution transactions use SSL encryption, and electronic interactions with payment gateways and other exchanges of sensitive constituent information are always encrypted. In accordance with our PCI-DSS compliance, we do not retain credit card numbers after transactions have been completed.

Privacy

Blue State Digital works hard to protect the privacy of user information stored on its servers. Clients maintain ownership of user data collected on their web sites. Each client database is kept in its own “silo” within our systems to prevent one client from ever accessing another client’s data.  Blue State Digital staff is trained in the importance of protecting personal information. Blue State Digital will never distribute user information without the express permission of the client (or a court order compelling us to do so).

Disaster Recovery

Blue State Digital maintains extensive redundancy in our systems and network architecture, including redundant load balancers, two internal networks with automatic failover, fault-tolerant storage systems, multiple web and email servers, and hot standby database servers.

Didn't find the answer you were looking for?

Email us at help@bluestatedigital.com