Keeping our clients' data secure is an absolute top priority at WeGroup. Our goal is to provide a secure environment, while also being mindful of application performance and the overall user experience.
WeGroup's infrastructure is hosted in a fully redundant, secured VPN environment, with access restricted to operations support staff only. This allows us to leverage complete firewall protection, private IP addresses, and other security features.
WeGroup employs strict security standards and measures throughout the entire organization. Every team member is trained and kept up to date on the latest security protocols. We regularly undergo testing, training, and auditing of our practices and policies.
DigitalOcean's infrastructure is secured through a defense-in-depth layered approach. Access to the management network infrastructure is provided through multi-factor authentication points which restrict network-level access to infrastructure based on job function utilizing the principle of least privilege. All access to the ingress points are closely monitored, and are subject to stringent change control mechanisms.
Systems are protected through key-based authentication and access is limited by Role-Based Access Control (RBAC). RBAC ensures that only the users who require access to a system are able to login. We consider any system which houses customer data that we collect, or systems which house the data customers store with us to be of the highest sensitivity. As such, access to these systems is extremely limited and closely monitored.
All WeGroup web application communication is send over HTTPS, We use high industry standard algorithms such as aes256 and sha256. WeGroup also actively monitors ongoing security, performance and availability 24/7/365.
What is this document, why does it exist, what does it cover, and who is in charge of it?
This policy denes behavioral, process, technical, and governance controls pertaining to security at WeGroup that all personnel are required to implement in order to ensure the condentiality, integrity, and availability of the WeGroup service and data (“Policy”). All personnel must review and be familiar with the rules and actions set forth below.
This Policy denes security requirements for:
In the event of a conflict, the more restrictive measures apply.
This Policy was created in close collaboration with and approved by WeGroup executives. At least annually, it is reviewed and modified as needed to ensure clarity, sufficiency of scope, concern for customer and personnel interests, and general responsiveness to the evolving security landscape and industry best practices.
The WeGroup security team oversees the implementation of this Policy, including
What are WeGroup’s expectations of its personnel and the workplace regarding systems and data?
WeGroup is committed to protecting its customers, personnel, partners, and the company from illegal or damaging actions by individuals, either knowingly or unknowingly in the context of its established employment culture of openness, trust, maturity, and integrity. This section outlines expected personnel behaviors affecting security and the acceptable use of computer systems at WeGroup. These rules are in place to protect our personnel and WeGroup itself, in that inappropriate use may expose customers and partners to risks including malware, viruses, compromise of networked systems and services, and legal issues.
The first line of defense in data security is the informed behavior of personnel, who play a significant role in ensuring the security of all data, regardless of format. Such behaviors include those listed in this section as well as any additional requirements specified in the employee handbook, specific security processes, and other applicable codes of conduct.
All employees and contractors must attend the WeGroup security training program, offered at least twice annually, to inform all users of the requirements of this Policy.
It is the responsibility of all personnel to take positive action to maintain physical security. Challenge any unrecognized person present in a restricted office location. Any challenged person who does not respond appropriately should be immediately reported to supervisory sta and the security team. All visitors toWeGroup offices must be registered as such or accompanied by a WeGroup employee.
Personnel should maintain workspaces clear of sensitive or confidential material and take care to clear workspaces of such material at the end of each workday.
Unattended devices must be locked. All devices will have an automatic screen lock function set to automatically activate upon no more than fifteen minutes of inactivity.
Systems are to be used for business purposes in serving the interests of the company, and of our clients and partners in the course of normal business operations. Personnel are responsible for exercising good judgment regarding the reasonableness of personal use of systems. Only WeGroup-managed hardware and software is permitted to be connected to or installed on corporate equipment or networks and used to access WeGroup data. WeGroup-managed hardware and software includes those either owned by WeGroup or owned byWeGroup personnel but enrolled in a WeGroup device management system. Only software that has been approved for corporate use by WeGroup may be installed on corporate equipment. All personnel must read and understand the list of prohibited activities outlined in this Policy. Modifications or configuration changes are not permitted without explicit written consent by the WeGroup security team.
Use of removable media such as USB drives is prohibited. Personnel may not configure work devices to make backups or copies of data outside corporate policies. Instead, personnel are expected to operate primarily “in the cloud” and treat local storage on computing devices as ephemeral. WeGroup data must be saved to company-approved secure cloud storage (e.g. Google Docs) to ensure that even in the event of a corporate device being lost, stolen, or damaged, such artifacts will be immediately recoverable on a replacement device.
The following activities are prohibited. Under certain conditions and with the explicit written consent of the security team, personnel may be exempted from certain of these restrictions during the course of their legitimate job responsibilities (e.g. planned penetration testing, systems administration sta may have a need to disable the network access of a host if that host is disrupting production services).
The list below is by no means exhaustive, but attempts to provide a framework for activities which fall into the category of unacceptable use.
Personnel devices and their software configuration may be managed remotely by members of the security team via configuration-enforcement technology. Such technology may be used for purposes including auditing/installing/removing software applications or system services, managing network configuration, enforcing password policy, encrypting disks, copying data files to/from employee devices, and any other allowed interaction to ensure that employee devices comply with this Policy.
All software programs, data, and documentation generated or provided by personnel while providing services to WeGroup or for the benefit of WeGroup are the property of WeGroup unless otherwise covered by a contractual agreement.
While WeGroup’s network administration desires to provide a reasonable level of privacy, users should be aware that the data they create on the corporate systems remains the property of WeGroup. Due to the need to protect WeGroup’s network, management does not intend to guarantee the privacy of personnel’s personal information stored on any network device belonging to WeGroup. Personnel are responsible for exercising good judgment regarding the reasonableness of personal use such as general web browsing or personal email. If there is any uncertainty, personnel should consult the security team or their manager.
Personnel should structure all electronic communication with recognition of the fact that the content could be monitored and that any electronic communication could be forwarded, intercepted, printed, or stored by others.
WeGroup reserves the right, at its discretion, to review personnel’s files or electronic communications to the extent necessary to ensure all electronic media and services are used in compliance with all applicable laws and regulations as well as corporate policies.
WeGroup reserves the right to audit networks and systems on a periodic basis to ensure compliance with this policy. For security and network maintenance purposes, authorized individuals within WeGroup may monitor equipment, systems and network traffic at any time.
Background checks may be conducted on all employees prior to their start date. The consequences of problematic background check results may range from a limitation of security privileges, to revocation of employment offer, to termination.
The security team maintains a company-wide security awareness program delivered to all personnel at least annually. The program covers security awareness, policies, processes, and training to ensure that personnel are sufficiently informed to meet their obligations. Those most responsible for maintaining security at WeGroup, including the security team itself as well as key engineering/operations staff, undergo more technical continuing education.
In the case of personnel termination or resignation, the security team coordinates with human resources to implement a standardized separation process to ensure that all accounts, credentials, and access of outgoing employees are reliably disabled.
Access to WeGroup offices is mediated by an electronic control system that provides for identity-aware entrance, programmable control over access time of day, and audits of use. All doors shall remain locked at all times under normal business conditions. The security team may provide approval to unlock doors for short periods of time in order to accommodate extenuating physical access needs.
Internet-based security cameras are positioned to record time-stamped video of ingress/egress, which are stored off-site.
Internet access shall be provided to devices via wired ethernet and WPA2 wifi. Networking switches and routers shall be placed in a locked networking closet with only the security team having access. WeGroup executives and the security team may grant access to the networking closet to individuals on a case-by-case and as-needed basis. A network firewall that blocks all WAN-sourced traffic shall be put in place. WAN-accessible network services shall not be hosted within the office environment.
How does WeGroup define, control, and maintain user identity and permissions for personnel?
Each individual having access to any WeGroup-controlled system does so via a G Suite user account denoting their system identity. Such user accounts are required to have a unique username, strong password of at least 8 characters, and two-factor authentication (2FA) mechanism.
Logins by personnel may originate only from WeGroup-managed devices. Authentication is performed by Google’s account management system, details of which can be found at https://gsuite.google.com/security. WeGroup leverages G Suite’s facilities of detecting malicious authentication attempts. Repeated failed attempts to authenticate may result in the offending user account being locked or revoked.
Whenever available, third-party systems must be configured to delegate authentication to WeGroup’s G Suite account authentication system (described above) thereby consolidating authentication controls into a single user account system that is centrally managed by the security team.
When authentication to G Suite is not available, unique strong passwords must be created and stored in the WeGroup approved password management system. Passwords must be paired with two-factor/MFA authentication.
User accounts are revoked (that is, disabled but not deleted) immediately upon personnel separation. As a further precaution, all user accounts are audited at least quarterly, and any inactive user accounts are revoked.
WeGroup adheres to the principle of least privilege, and every action attempted by a user account is subject to access control checks.
WeGroup employs a role-based access control (RBAC) model utilizing Google-supplied facilities such as organizational units, user accounts, user groups, and sharing controls.
WeGroup may require use of a specified web browser(s) for normal business use and for access to corporate data such as email. For certain specified roles such as software development and web design, job activities beyond those mentioned above necessitate the use of a variety of browsers, and these roles may do so as needed for those activities.
Any browser that is allowed to access corporate data such as email is subject to a whitelist-based restriction on the which browser extensions can be installed.
Access to administrative operations is strictly limited to security team members and further restricted still as a function of tenure and the principle of least privilege.
Access control policies are reviewed regularly with the goal of reducing or refining access whenever possible. Changes in job function by personnel trigger an access review as well.
Upon termination of personnel, whether voluntary or involuntary, the security team will follow WeGroup’s personnel exit procedure, which includes revocation of the associated user account and reclamation of company-owned devices, office keys or access cards, and all other corporate equipment and property prior to the final day of employment.
How does WeGroup build, adopt, configure, and maintain technology to fulfill its security intentions?
WeGroup stores source code in its own hosted git service. The security and development teams conduct code reviews and execute a static code analysis tools on every code commit. Reviewers shall check for compliance with WeGroup’s conventions and style, potential bugs, potential performance issues, and that the commit is bounded to only its intended purpose.
Security reviews shall be conducted on every code commit to security-sensitive modules. Such modules include those that pertain directly to authentication, authorization, access control, auditing, and encryption.
All major pieces of incorporated open source software libraries and tools shall be reviewed for robustness, stability, performance, security, and maintainability.
The security and development teams shall establish and adhere to a formal software release process.
The WeGroup security and development teams shall document the configuration of all adopted systems and services, whether hosted by WeGroup or are third party hosted. Industry best practices and vendor-specific guidance shall be identified and incorporated into system configurations. All configurations shall be reviewed on at least an annual basis. Any changes to configurations must be approved by appointed individuals and documented in a timely fashion.
System configurations must address the following controls in a risk-based fashion and in accordance with the remainder of this policy:
For every third-party service that WeGroup adopts, the security team shall review the service and vendor, on an annual basis, to gain assurance that their security posture is consistent with WeGroup’s for the type and sensitivity of data the service will store.
How does WeGroup manage data classifications and data processing?
WeGroup maintains the following classes and processing rules of customer data. For each data class, the WeGroup security and development teams must provision and dedicate specific information systems in DigitalOcean to store and process data of that class, and only data of that class, unless otherwise explicitly stated throughout Section 5. For all classes of customer data, the corresponding systems may store and process data items needed to keep each customer’s data properly segmented, such as WeGroup customer identifiers.
This is data pertaining to login accounts for the www.wegroup.be customer web interface, used by WeGroup customer agents. This data shall be encrypted-at-rest so as to protect the data in the event of unauthorized access attempts. User account credentials shall be hashed in such a manner that the plaintext passwords cannot be recovered.
This is contact data about WeGroup customers and customer agents.
This is data pertaining to the customer-specific preferences and configurations of the WeGroup service made by customer agents.
This is data that the WeGroup service collects during session recording. The WeGroup security and development teams must provision specific systems within DigitalOcean to store and process this class of data. This data shall be encrypted-at-rest so as to protect the data in the event of unauthorized access attempts.
This is metadata about transactions conducted on all other classes of customer data. This includes customer organization and user identifiers, standard syslog data pertaining to customer users, and instances of Customer Contact Data and Customer Preferences Data. This class does not include Customer Recorded Data.
Customer Contact Data, Customer Preferences Data, and Customer Event Transaction Metadata may be stored and processed in systems hosted in environments other than DigitalOcean, as approved by the security team.
WeGroup employees may access Customer Data only under the following conditions.
WeGroup provides web user interfaces (UIs), application programming interfaces (APIs), and data export facilities to provide customers access to their data.
The security team in conjunction with executive management may approve emergency exceptions to any of the above rules, in response to security incidents, service outages, or significant changes to the WeGroup operating environment, when it is deemed that such exceptions will benefit and protect the security and mission of WeGroup, WeGroup customers, and visitors of WeGroup customers’ websites.
How does WeGroup detect, and respond to vulnerabilities and security incidents?
The WeGroup security and development teams shall use all of the following measures to detect vulnerabilities that may arise in WeGroup’s information systems.
The WeGroup security team shall evaluate the severity of every detected vulnerability in terms of the likelihood and potential impact of an exploit, and shall develop mitigation strategies and schedules accordingly. Suitable mitigations include complete remediation or implementing compensating controls.
The WeGroup security team shall use all of the following measures to detect security incidents.
The WeGroup security team shall make a determination of whether every indicator is representative of an actual security incident. The severity, scope, and root cause of every incident shall be evaluated, and every incident shall be resolved in a manner and timeframe commensurate with the severity and scope.
In the event that a data breach affecting a customer has been detected, WeGroup will maintain communication with the customer about the severity, scope, root cause, and resolution of the breach.
How will WeGroup prevent and recover from events that could interfere with expected operations?
WeGroup services hosted in DigitalOcean shall be configured in such a manner so as to withstand long-term outages to an availability zone and region. WeGroup infrastructure and data is replicated in multiple geographic regions to ensure this level of availability. WeGroup targets a Data Recovery Point Objective (RPO) of near zero for at least 7 days, and up to 24 hours beyond 7 days.