Cliclease Security: Your data in the best hands

Certifications & audits

As the security and privacy of your data is our priority, we take every step necessary to assure our clients of this commitment. This includes voluntarily undergoing the lengthy process of independent third-party certification based on industry standards.

As part of Cliclease SOC 1 Type II & SOC 2 Type II audit report, which is released on an annual basis by a global 3rd party auditing firm, Cliclease has implemented and adheres to strict information protocols, including the security, availability, processing integrity, confidentiality, and privacy of our partners’ data. 

The above SOC reports, penetration test reports, and other certifications are available in December of each year to our partners and prospects upon request. To request any of our certifications or reports, click here. 

GDPR requirements

As a SaaS provider, Cliclease has comprehensively evaluated GDPR requirements and implemented numerous privacy and security practices to ensure our cloud solutions are meeting those requirements.These practices include:

• • Search for records within the app, with support to remove specific information if needed.
  • Providing our clients with configurable privacy and compliance settings such as using their own SSO, controlling who can access the application and what kind of information, and more.
  • Providing sufficient data transfer methods to our clients.
  • Maintaining records of processing activities.
  • Training employees on security and privacy practices.

​

Encryption of data at rest and in transit

Users accessing Cliclease solutions via the internet are protected by Transport Layer Security (TLS) and Hypertext Transfer Protocol Secure (HTTPS). All data, including backups, are fully encrypted using AES 256 for data at rest (See “Encryption key management”) and TLS 1.3 for Data in transit.

Encryption key management

Encryption of data at rest is possible by leveraging a solution from our global cloud service provider and is managed by software, avoiding exposure to any human. To ensure maximum security, the keys are not managed by anyone. They are only visible to the client instance and can be used to decrypt data within the instance only. Also, note that the key management complies with FIPS 140-2, which provides independent assurances about the confidentiality and integrity of our key management. As part of our application architecture, we ensure your databases are logically separated from other clients, thus increasing the security of your data.

User authentications and profiles

Cliclease’s authentication and authorization setup uses industry best practices and standards and allows clients to either leverage their own single sign-on or use Cliclease Identity & Access Management. Cliclease offers role-based access, meaning the clients can decide how to grant access to each user.

​

How do Cliclease engineers access the systems to provide support?

Under Cliclease’s Access Management policy, when an issue is raised via our support ticketing system, our support team will request client approval for temporary access to investigate and resolve the issue for the specific environment/s. This access is granted for a limited time, enough to resolve the ticket with auto closure enabled by the system when access is approved.

In addition to our annual third-party SOC audit, and as part of Cliclease’s Access Management policy, internal audits are performed regularly:

• High privileged and user accounts review is performed at least twice a year. 
• Logs are reviewed monthly. 
• Monitoring tools are in place with notification to appropriate individuals for abnormal events/activities. 
• Access authorizations and requests are reviewed periodically. 

Cloud infrastructure access and authorization

For greater security while accessing our cloud infrastructure, Cliclease has an Access Control List (ACL) that ensures only pre-approved cloud engineers can perform specific tasks defined by their roles. To access the cloud infrastructure, we utilize multi-factor authentication (MFA), which requires approval from different managers and heads of departments, with the final required approval from our Chief Security Officer. 

In addition to our annual third-party SOC audit, and as part of Cliclease’s Access Management policy, internal audits are performed regularly to review such accesses and corresponding logs.

Application logs & auditing

Application logs enable you and your auditors to review all the activities performed by the users and the system to ensure data integrity. We allow our clients and their auditors to leverage our ITGC capabilities and log all types of activities and data transfers in the system. 

You can easily review and download all the logs, which demonstrate all types of activities by the users, such as system access, data, and configuration modifications, as well as system activities, such as automatic jobs and other data communications between Cliclease solutions and any other solutions integrated, directly from the Cliclease applications. You can also revert actions when needed.

Secure Software Development Life Cycle (SSDLC)

Security is at the core of our software design. We’ve adopted numerous best practices and leverage the OWASP framework for our software development to ensure security by design right from the start.

Code Review

All changes to our code are tested by our Quality Assurance (QA) team, and criteria are established for performing code reviews, web vulnerability assessments, and advanced security tests. We conduct manual and automated code reviews before checking in code. After code checks, the QA teams perform regression and functionality tests. In addition, we also use in-house and third-party solutions such as Veracode to conduct vulnerability assessments and security tests on our application. Vulnerability tests are carried out before each release, and as often as needed, where we test the solution from A to Z. Upon development, we deploy in a lower environment to enable stakeholders to test the solution before deployment in the production system. All such activities are recorded as part of our change management policy.

Quality assurance

Each product release is put through a stringent functionality test, performance tests, stability tests, and UX tests before they are released. We validate the releases in internal builds followed by lower environments before pushing them to the production system following our change management policy.

Vulnerability assessment & penetration testing

We use various tools for analyzing the code and checking for security vulnerabilities, such as Veracode and OWASP, before any release. Our strategy is to prevent security vulnerabilities first, then use industry-standard validation tools and techniques to validate that prevention worked. Issues identified through vulnerability assessments, penetration tests, and network vulnerability scanning are prioritized based on criticality and risk.  

Vulnerability scans, including SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), Container and Dependency Scanning, and Penetration Testing, are carried out in every release and as often as needed. Following the best practices of OWASP, we aim to identify and remove standard and advanced web application security vulnerabilities, including, but not limited to, the following:   

• Cross-site request forgery (CSRF)   
• Cross-site scripting (XSS)  
• Improper input handling (SQL injection, XML injection…) 
• HTTP response splitting   
• Authentication and authorizations  

We leverage a global 3rd party auditing firm to perform penetration testing on our solution, and the report on such tests can be provided to you upon request. We also offer all our SaaS clients the ability to conduct penetration testing on the lower environment of the solution, enabling you to evaluate Cliclease’s cloud security and measures yourselves. In order to perform a penetration test, please discuss your penetration testing needs with your Cliclease Client Success Manager.

Malware protection

Cliclease Cloud only uses non-Windows operating systems, and all systems follow a hardening baseline policy for security management. Note that our deployment architecture is based on DMZ, and no end-user access is available to server resources at the OS level. User-uploaded documents are not stored in the server file system and are not accessed at the server level. Also, Intrusion Detection Systems and Intrusion Protection Systems (IDS/IPS) and firewall layers secure inbound and outbound access on system ports, monitoring and reporting login attempts, account creations, and periods of system non-availability. All Cliclease employees use systems that have antimalware, supporting real-time scanning and security, and automatic updates are enabled on devices.

Security Monitoring​

We have various security measures and systems that continuously monitor for malicious activity, attacks, and unauthorized behavior from multiple perspectives. Our team can mitigate any potential attacks by following the internal procedure set for such events.