Penetration Testing
Vurbalize conducts thorough system checks at least once a year with industry-leading cybersecurity. Our product and cloud systems are fully open for these examinations, with the testers having access to our source code for optimal results. We make summaries of these penetration tests available in our Trust Report.
Vulnerability Scanning
Vurbalize performs vulnerability checks at crucial stages in our Secure Development Lifecycle (SDLC):
- Static analysis of code during code reviews and continuously
- Analysis of our software for known vulnerabilities
- Scanning to prevent malware in our software
- Dynamic testing of active applications
- Regular network vulnerability scanning
- Continuous monitoring of new assets that are externally facing
Enterprise Security Device Protection
Vurbalize keeps all company devices under control with mobile device management software and malware protection. We consistently monitor device security alerts. We ensure devices are set up securely, such as disk encryption, screen lock configuration, and software updates.
Vendor Security
Vurbalize evaluates vendors based on risk, considering factors such as:
- Access to customer and company data
- Integration with production environments
- Potential harm to Vurbalize's reputation
Once we identify the inherent risk, we assess the vendor's security to decide on approval.
Secure Remote Access
Vurbalize uses secure remote access to internal resources, and use malware-blocking DNS servers to protect employees and their devices while online.
Security Training
Vurbalize offers all employees robust security training, both during onboarding and annually. This training includes a mandatory live session on key security principles for all new hires. In addition, new engineers are trained in secure coding practices. Our security team regularly updates employees on threats requiring attention or action.
Identity and Access Management
Vurbalize uses Google to manage identities and access. Access to applications is based on an employee's role and is automatically revoked upon employment termination. Any additional access requires approval as per app-specific policies.
Data Privacy
Vurbalize prioritizes data privacy and aims to responsibly manage all sensitive data.
Regulatory Compliance
Vurbalize is SOC 2 compliant and continually reviews updates to regulations and evolving frameworks to refine our program.