Security Policies

The information in any of its variants (text, documents, images, videos) collected by Jarboss is protected by strict security and confidentiality practices within our regulations. To ensure the integrity and confidentiality of our clients' data, Jarboss relies on 6 main fundamentals:

1. Keep our network infrastructure protected and monitored.
2. Ensuring the storage of data within strongly secured servers at the hardware and software level.
3. Protect the data during the transmission and transaction with said servers.
4. Optimization and maintenance of our servers.
5. Administration and maintenance of our applications.
6. Restrict access to physical data.

Information about the security policies.

1. Maintenance and security of the network architecture to protect the information.
   1. Communication with the databases and contents of any network are restricted by a single gateway that allows access only to local servers and not to the rest of internet traffic, thus isolating internet traffic data not approved.
   2. The firewall hardware configuration includes:
      1. Restriction rules for traffic classified as dangerous on the internet.
      2. Restriction rules to insistent traffic to restricted areas of our servers.
      3. Restriction rules to attacking traffic by brute force to the API.
      4. Adequate management in all communication ports of our servers.


2. Secure third-party systems or services that store sensitive data
   1. Access passwords provided by third parties are never used, they are reinforced by encryption algorithms and are changed immediately
   2. Third-party services or applications are ensured by changing the default values and filtering them using our security techniques
   3. All administrative accesses to our servers are encrypted.
      1. Administration access via the web is ensured by the SSL / TLS protocol and the information travels encrypted in all areas of exchange or use of passwords.
      2. The administration access via console is ensured by the SSH protocol where the correct access and modification permissions have been determined for specific administrators.


3. Protection of sensitive data during transmission through the API and during storage.
   1. Client passwords are strongly protected by compromise.
      1. Client passwords are never transmitted using insecure protocols, passwords travel protected using SSL / TLS.
      2. The passwords of our clients are duly encrypted before being stored on our servers.
      3. Administrators never ask customers for their passwords.
      4. For the recovery of any password it is required to send a unique token via email that can only be used once to change the password.
   2. User content is always transmitted using secure protocols.
      1. Web-based applications collect customer data only through the SSL / TLS protocol and are transmitted in encrypted form.
      2. Access to the API is always done through HTTPS.
      3. Backups of the content are always transmitted using the SFTP protocol.


4. Develop and maintain secure applications.
   1. All software applications are developed based on industry best practices and incorporate secure information during the development cycle based on spiral scalable prototypes.
   2. All changes to the system and software are constantly tested until the same optimal result is obtained in its operation after N number of experiments.
   3. The development, test and production environments are kept logically and physically separate.
      1. Production information is never used for testing, updating or master samples.
      2. All test information (accounts, content, documents) are removed before releasing any new version.
      3. All temporary accounts (users and passwords) are removed from the application before being released for client use.
   4. The source code is reviewed and applications are periodically tested for security and vulnerabilities especially related to:
      1. Data entries that pose a risk to the integrity of the database of any network.
      2. Broken or vulnerable access to user accounts.
      3. Malicious manipulation of user IDs.
      4. Malicious scripting injection to client. [Cross-site scripting (XSS) attacks]
      5. Data injection by SQL injection. (Corrupt or malicious data entered directly into the database)
   5. All processes with sensitive client data, run at a low level where they are difficult to capture, this avoids confusion or corruption of data towards other clients.


5. Strong access control methods.
   1. Access to our clients' information is limited for the staff. Only authorized personnel can access this information.
   2. All users are identified with a unique name before being allowed access to customer information.
   3. All passwords are encrypted during transmission and storage.
   4. All login attempts representing access to a client's content is duly recorded and monitored.
   5. User and password administrative procedures are implemented on all systems, including:
      1. Centralized control of addition, removing and modifying users or content.
      2. Verification procedures before updating or making a password change.
      3. Access revoked immediately after unsubscribing users.
      4. Establishing and communicating our password policy includes:
         1. Do not use shared or generic accounts.
         2. Passwords must be changed at least every 90 days.
         3. Passwords must contain at least 8 characters.
         4. Passwords should not be dictionary words, names, or places.
         5. Passwords must contain alphanumeric characters.
         6. Passwords should never be disclosed to anyone, including administrators.


6. Restrict physical access to the data center.
   1. Physical access to systems that store, process or transmit customer information is limited and monitored.
   2. Security cameras are used to monitor sensitive areas; the videos are stored for a minimum time of at least 3 months.
   3. Backups are securely stored outside the main servers.
   4. The information supported is properly managed.

Jarboss uses a fault-tolerant and real-time distributed database replication system, in case one data center fails, another immediately takes its place with the complete information, additionally each server “mirrors” towards the production server thus allowing to always keep the databases distributed and updated. As an alternative security method every night, using the Round Robin-based chained mirroring technique, an encrypted copy is sent to our local servers in the city of Monterrey where they are split in tar.gz and are completely unreadable on local servers.