Metadrop Security Commitment

Our commitment to security and privacy

We take security and privacy seriously at Metadrop, and place them as a high priority in our daily operations.

This technical document describes Metadrop’s perspective on security and compliance, and highlights the measures we take to remain secure and compliant. It focuses on security controls and details the processes by which Metadrop protects our customers’ data.

Security is our priority

Our goal is to create a strong security culture among all Metadrop employees. We firmly believe that each employee is an essential part of our defense against potential security breaches.

This culture has a strong impact on all employees and is present during the hiring process, employee onboarding and as part of ongoing employee training. All our employees must be familiar with our security policies and receive security training as part of the onboarding process and receive regular security training during their time here at Metadrop. During the onboarding process, new employees sign our NDA and undergo security training. This demonstrates our commitment to keeping our customers’ data safe.

All employees working at Metadrop must follow our lock and password security policy, use secure authentication (two-factor, HTTPS, etc.), have encrypted hard drives, have a secure Wi-Fi connection and be connected via VPN when connecting remotely.

Security development practices

Metadrop developers in the IT segment receive guidance on topics including clean coding (e.g., PHPcs, PHPcpc, PHPmd) and development best practices (e.g., Drupal coder), and the principle of least privilege (e.g., roles, users, permissions) when granting access rights. The IT department also monitors various security channels to stay up to date on any threats or bad practices.

Security monitoring

The Metadrop security team is responsible for monitoring any suspicious activity, addressing cybersecurity threats and conducting regular health checks and audits.

In addition, our team is tasked with monitoring GDPR compliance and other data protection laws, our data protection policies, awareness, training and GDPR audits.

Security management

Endpoint Security

We ensure that all our endpoint devices are protected in accordance with our Endpoint Security Policy. This includes all our endpoints having disk encryption, malware protection, disabled guest access and having an operating system updated periodically. We also carry out continuous checks to ensure we maintain this high level of security.

Vulnerability management

Metadrop has a vulnerability management policy that includes processes such as regular web scans (e.g., OWASP-based DAST, Mozilla Observatory) and security list monitoring (e.g., Drupal security list) to detect potential threats. Once a vulnerability requiring our attention is identified, it is followed up, prioritized according to its urgency and assigned to relevant people as a ticket. Our security team tracks these issues and follows up periodically until they can verify that they have been resolved.

Availability

We work with top-tier providers for our project allocation, we work with hosting platforms such as Acquia, OVH, or Hetzner; project management tools such as Asana, Jira or Trello and repository providers to store code such as GitLab, GitHub or Bitbucket.

All providers have a geographically distributed environment to support service availability. Data is distributed across a high-availability infrastructure, designed to store extremely large amounts of data on many servers.

Incident management

Metadrop has a well-defined incident management process for security events that may affect the confidentiality, integrity or availability of our client’s resources or data. If an incident occurs, the security team identifies it, reports it, assigns it to the correct resolver and prioritizes its resolution based on its urgency. Events that directly affect our clients are always given the highest priority and the shortest resolution time. This process includes action plans, identification, escalation, mitigation and reporting procedures.

Quality assurance

It is vital for us to properly test all new features before deploying them to ensure that no unexpected vulnerabilities are introduced into the application. The quality control team ensures that all new additions to our application are error-free before release. They also test new private instances for our new clients just before they reach our Customer Service team.

Traceability

All our processes are logged, we use Version Control Systems (e.g., GIT), Ticketing Systems (e.g., JIRA, Asana) and server logs that are reviewed periodically to detect any potential issues.

Protection of our customers’ data

Data encryption

Whenever we store data, we do so with external providers, usually contracted directly by the client, who have multiple layers of encryption.

GDPR compliance

Metadrop helps our clients find the best ways and tools to comply with GDPR.

Updated: September 2021