Security and Compliance

Introduction

The security of our customers’ and partners’ data is core to our DNA at Psithur; as a startup, we focus on architecture and processes that are achievable and sustainable and, as we grow, we make a strong commitment to scaling up our investment in security and compliance.

We are also committed to performing regular external audits of our processes and products including penetration tests.

This page contains a high level overview of our security posture: if you'd like to read our more detailed whitepaper please get in touch.

Psithur and Google Cloud Platform

As a Google Cloud Partner, we offer Psithur Connect and associated services exclusively on Google Cloud Platform. For our Australian customers, this includes all customer data hosted in Google Cloud’s Sydney region.

Organisation structure and policy

Psithur Connect is deployed on a regional basis where-by each region (for example, Australia) is deployed in its own Google Cloud Project.

This isolates the application resources in a particular region from those in other regions and from other environments (such as test, development and audit).

Using regional resources provides a number of benefits including the ability to ensure customer data is stored and processed in a specific physical location.

The resource hierarchy allows us to apply management and security policies to our Cloud Infrastructure at the highest level that makes sense (for example, audit logs are managed and collected at the organisation level).

We only ever store or process customer and partner data in production environments: our test, development and audit environments are used for those purposes exclusively.

Any connections between projects are managed using carefully scoped service-accounts according to the “least privileged” principle.

Authentication and authorization

Administrators

For Psithur Cloud Infrastructure administrators, we use Context Aware Access (which enables granular access control policies based on attributes such as user identity, location and device security status) and limit access to all of our Cloud Infrastructure to managed Chrome-OS devices with hardened security profiles (for example, while external USB media can be inserted into one of these devices, it is not possible to write any data to it).

End-user (Psithur Connect) accounts

Psithur Connect customers and users authenticate using Google Cloud Identity Platform (GCIP) which allows us to offer federated login using a variety of corporate accounts such as Microsoft (including Office 365), Google Accounts as well as federated SAML and OICD providers.

Psithur Connect users login using their existing organisation’s accounts, and we use customisable rules (such as domain names or allowed user lists) to assign each user to their organisation specific Psithur Connect workspace. When using a federated authentication provider, password resets and other account management activities are performed by the account provider, not Psithur, nor does Psithur store or manage user passwords.

Each user is assigned a unique identifier by GCIP, which Psithur Connect uses to identify that user in our system. All authentication actions (successful and start of flow) are logged to the audit environment. 

For those organisations that require a higher level of security, or additional steps to help protect user accounts from phishing attacks, Psithur Connect can enforce additional multi-factor authentication (MFA) methods (such as SMS) and/or customisable zero-trust policies such as geography based access controls. Ask us for more details and pricing.

Once the user successfully authenticates using their federated identity provider, GCIP issues a cryptographically signed Javascript Web Token (JWT) that identifies the user.

Networking (segmentation and security)

This diagram illustrates the high level components that are used to serve Psithur Connect to the end-user. A simplified network path of traffic from the end-user’s device to the application and storage services where customer data is stored is also shown.

Some of the infrastructure is shared, while some is dedicated to each customer.

Secure Development Lifecycle

Automated application build and testing

We use continuous integration tools on Google Cloud Platform that - for each change to the Psithur Connect source code - build the application container and run a series of tests. Only if all the tests pass, does the container get retained as a candidate for testing in the test environment (and for eventual deployment to the production environment).  

Our automated test suite includes both functional tests that operate on the Psithur Connect server component only, as well as full integration tests that start the server and use a real web browser to load the Psithur Connect interface and perform user actions in the web browser to simulate how real users interact with Psithur Connect. This helps maintain the quality of our software by catching regressions and bugs at the earliest possible phase of the software development lifecycle.

If these tests pass, we also perform a vulnerability scan of the application container using Google Container Analysis and Vulnerability Scanning. If any vulnerabilities of level HIGH or above are detected, the application is not allowed to be used until a manual review of the vulnerability has been conducted, or the vulnerability has been remediated.

Policies and procedures

Much of this page has detailed the technical security controls we have in place. As important as these are our policies and procedures.

Australian Privacy Principles 

We publish our most up-to-date privacy policy on our website which sets out how we collect and treat personal information.

Security Incident Response

Our Security Incident Response processes are lightly based on Google’s data incident response process. A copy of this is available to customers (or prospective customers) for review upon request. 

Responsible Disclosure Policy

We have a responsible disclosure policy which welcomes feedback from security researchers and the general public to help improve our security. 

It’s available on our website at https://psithur.com/security-disclosure/

Data breach response plan 

Our data breach response plan is available to customers (or prospective customers) for review upon request.