Security Policy

Security is foundational to everything we do at Supra eKEY Systems. This policy describes our security practices, the controls we apply to protect your data and property access, and how to report security vulnerabilities responsibly.

1. Encryption

Data at Rest

• All user data, access keys, and logs are encrypted using AES-256-GCM.
• Encryption keys are stored separately in a Hardware Security Module (HSM) and rotated quarterly.
• Database backups are encrypted before transmission and storage.

Data in Transit

• All API communications and web traffic use TLS 1.3. TLS 1.2 is the minimum; older versions are rejected.
• Perfect Forward Secrecy (PFS) is enforced so past sessions cannot be decrypted even if keys are later compromised.
• Certificate pinning is implemented in our mobile applications.
• HSTS (HTTP Strict Transport Security) is enabled with a 1-year max-age.

Credential Hashing

• User passwords are hashed using PBKDF2-SHA256 with 100,000 iterations and a unique cryptographically random salt per credential.
• Admin credentials are additionally protected with mandatory multi-factor authentication.
• eKey identifiers are derived using cryptographically secure random number generators (CSPRNG).

2. Access Controls

• Principle of Least Privilege: Employees and systems are granted only the minimum access required for their role.
• Multi-Factor Authentication: Required for all administrative system access and encouraged for all user accounts.
• Session Management: Admin sessions expire after 30 minutes of inactivity. All sessions use cryptographically random tokens.
• Rate Limiting: Login attempts are rate-limited and accounts are automatically locked after 5 consecutive failures for 15 minutes.
• IP Allowlisting: Production infrastructure is accessible only from approved, audited IP ranges.
• Privileged Access Management (PAM): All privileged operations require dual authorization and are fully logged.

3. Infrastructure Security

• Our infrastructure is hosted in SOC 2 Type II certified data centres.
• Network segmentation separates production, staging, and development environments.
• Web Application Firewalls (WAF) protect against OWASP Top 10 vulnerabilities including SQL injection, XSS, and CSRF.
• DDoS mitigation is provided at the network layer with automatic traffic scrubbing.
• All infrastructure changes follow a change management process with rollback capability.

4. Monitoring and Logging

• All access events, API calls, and administrative actions are logged with tamper-evident audit trails.
• Logs are retained for a minimum of 3 years and stored in write-once, append-only storage.
• Real-time alerting for: failed authentication attempts, unusual access patterns, off-hours administrative access, and geographic anomalies.
• Security Information and Event Management (SIEM) provides centralized log analysis and correlation.

5. Application Security

• Secure Software Development Lifecycle (SSDLC) with mandatory security review at each development stage.
• Static and dynamic code analysis integrated into the CI/CD pipeline.
• Third-party dependency scanning for known vulnerabilities (CVEs) run on every build.
• Content Security Policy (CSP) and other security headers implemented on all web properties.
• Input validation and output encoding applied throughout all user-facing interfaces.

6. Security Testing

• Annual penetration testing performed by independent, certified security firms.
• Continuous automated vulnerability scanning of public-facing systems.
• Regular red team exercises and tabletop incident response simulations.
• Mobile application security testing aligned with OWASP Mobile Security Testing Guide.

7. Incident Response

We maintain a comprehensive Incident Response Plan (IRP) that includes:

• Detection: Automated and manual detection of security incidents within minutes.
• Containment: Immediate isolation of affected systems to prevent spread.
• Notification: Affected users are notified within 72 hours of a confirmed data breach involving personal information, per GDPR requirements.
• Eradication & Recovery: Root cause elimination and verified restoration to normal operations.
• Post-Incident Review: Documented lessons learned and control improvements after every significant incident.

8. Employee Security

• Background checks for all employees with access to production systems or user data.
• Mandatory security awareness training upon hire and annually thereafter.
• Clear security policies and acceptable use agreements signed by all employees.
• Immediate credential revocation upon employee departure.

9. Compliance

Our security program is designed to meet or exceed requirements of:

• SOC 2 Type II
• GDPR (General Data Protection Regulation)
• CCPA (California Consumer Privacy Act)
• NIST Cybersecurity Framework
• OWASP Top 10 Application Security Risks