Back Up and Security Policy
1. Back-Up Policy
To ensure data consistency/integrity our system performs daily automated backups of our database via the Amazon Relational Database Service (RDS) (available at https://aws.amazon.com/rds/faqs). Moreover, our platform guarantees high availability by utilizing a Master - Slave replication scheme (more information about this scheme here: https://en.wikipedia.org/wiki/Replication_(computing).
2. Security Policy
TalentDesk.io encrypts all communications between the customer browser and our front-end/back-end services using HTTPS. The use of an encrypted communication channel ensures that the service is protected against man-in-the-middle (MitM) attacks. HTTPS also ensures the protection of the privacy and integrity of the exchanged data. The bidirectional encryption of communications between a user and the platform protects against eavesdropping and tampering with or forging the contents of the communication.
In practice, the above provides a reasonable guarantee that a user is indeed communicating with the website they intend to communicate with (as opposed to an impostor), as well as ensuring that the contents of communications between the user and platform cannot be read or forged by any third party.
On the infrastructure level TalentDesk.io leverages advanced protection mechanisms provided by Amazon Web Services (AWS). The AWS Web Application Firewall (AWS WAF) protects TalentDesk.io from common web exploits that could potentially affect application availability, compromise security or consume excessive resources. Moreover, the AWS Shield which is a managed Distributed Denial of Service (DDoS) protection service safeguards the platform in order to minimize downtime and promote high availability.
On the application level security is our number one priority when it comes to accessing and exchanging information. In TalentDesk.io we utilize JSON Web Tokens (JWT) which is an open standard that defines a compact and self-contained way for securely transmitting information between parties. This information can be verified and trusted because it is digitally signed using a secret (with HMAC algorithm). Moreover, special care is taken against common attacks like Cross-site request forgery (CSRF), Cross-site scripting (XSS) and SQL injection
Last updated: May 14, 2018