This is the second part of the security overview. The first part is Security: Data protection and personal information.

General Security

Risk classification

All customers should do their own risk classification of the data they store in Kundo's systems.

This list of statements about the data we store can be used to assess the risk level:

• Kundo stores customer information about the users. The information includes the name, e-mail address, and IP-number of each interaction.
• Kundo also stores the name, e-mail address, and (a securely hashed) password for each logged in editor in the system.
• Kundo stores the contents of each user's questions, which can include sensitive information, that will then be stored in unstructured form with us. Editors are responsible to prune information that users accidentally post to Kundo.
• Kundo stores information about how its services have been accessed in the form of log files. These log files exist for 30 days and are then deleted.
• Some of our customers store extra data for each user such as membership numbers or social security numbers. If that is the case, that information should be included in the risk assessment.

Employees

All Kundo employees share responsibility for customer support. To make the customer support flow efficient, Kundo employees with a direct need has access to customer data. All access to customer data is made through a web interface with user access controls in place, so that access for a user can be withdrawn at any time. Access is always withdrawn on end of employment, as part of our offboarding process.

Customer data is never stored on employee computers. For instance, all developers use dummy data during development instead of customer data.

All employees are given a walkthrough of our security policy upon employment, and are required to follow the procedures outlined there strictly. The security policy includes a password policy that states: 

• All employees should use a password manager 
• All employees should use 2-step verification for our own systems and everywhere else were possible

All employees are part of keeping our customers' data safe at all times and are educated to do so. The Security practices is developed and maintained by the Security team within the Development function.

Logging

Logging is done within Kundo's systems mainly for debugging purposes. Logs are only available to Kundo employees.

Examples of data that is logged in our systems:

• All web traffic to each public context hosted by Kundo, including IP and web browser
• All login attempts made at the SSH level against our servers
• All errors that occur thanks to usage of the service
• All e-mails sent by the service
• All backups saved, including the specific point in time they were made

A customer can ask for logs pertaining to their own use in the system given that the customer covers that cost and that Kundo agrees. Full logs can not be handed over since they may contain data the originates from other customers of Kundo's system.

All logs are automatically deleted after 30 days due to privacy agreements with our customers.

Logs are stored on a separate server from where log events originate. Since access control to the log server is handled separately from other servers, an intruder is prevented from tampering with logs.

Computer clocks are regularly synchronized to make sure all timestamps are as exact as possible.

Physical security

Kundo owns no physical servers and instead rents them from Amazon. Amazon is responsible for the physical security of the servers and has comprehensive security documentation.

Gaining access to the Kundo office where we work day-to-day does not automatically give anyone access to any of our services.

Operational security

Kundo has monitoring setup for all critical infrastructure. The goal of the monitoring is specifically focused on security but also performance and to find unusual traffic patterns.

The cloud environment is continuously monitored for malicious activity and unauthorized behavior.

Kundo maintains centralized visibility into our security posture through automated configuration checks, ensuring our infrastructure continuously conforms to security best practices and compliance frameworks.

The infrastructure and container workloads are continuously scanned for known software vulnerabilities and unintended network exposure.

All data transfer happens digitally, so no physical transfer of data is ever conducted.

All traffic flows from, to and between our services are encrypted, including all employee access to sensitive data.

All encryption, access, and otherwise secret keys are stored in encrypted form and are only available on the specific environment where they are used.

We continuously monitor industry standards and make updates to our setup accordingly.

Access security

There are three different kinds of users of Kundo's systems:

• Visitors can ask questions and comment on other's questions. If the customer only uses Kundo products without an interface for visitors (Kundo Mail), this role does not apply.
• Editors can edit and deleted questions and comments in the specific context they have given access rights in. When given the correct permissions they may also view statistics, edit channel settings and adjust account settings.
• Administrators are employees at Kundo and have access to all data in all contexts.

Access rights for different kinds of users:

• Editors must login with an e-mail address and password to access the service.
• Administrators must also log in, but need to have first been given administrator access by another administrator.
• To gain administrator access to the servers an administrator needs to identify with Two Factor Authentication.
• It is possible to limit the access of visitors and/or editors based on a custom integration scheme. If you are interested in this, contact us for more detailed information. The most straightforward custom integration is to only allow access for users that originate from a specific IP-range.

Day to day administration of who has editor access is controlled by the customer. If assistance is needed from an administrator the customer can ask for help through the normal support channels.

If an intrusion attempt that affects customer data is detected the customer is promptly contacted.

Development processes

Security solutions are based on industry best practices for protocols, authentication and encryption. We don't build our own security solutions and instead trust the proven work of others.

Software development is conducted in a way that ensures high quality, with testing built into the process throughout the process.

Environments used for testing are clearly separated from production systems.

Security incidents

Security incidents are handled according to Kundo's incident management process. 

Continued in Security: Continuity, compliance and encryption.