Learn about Elastio’s security and compliance protocols and protection.
Security is paramount at Elastio as a company, and our mission is to protect your critical data. We have dedicated resources and financial investment to ongoing independent third-party evaluations. SOC 2 compliance ensures that we safeguard customer data throughout our services and meet standards for strong operational effectiveness – a fundamental tenet of our offerings.
Elastio provides multiple security and compliance requirements while delivering access to our multi-tenant console. The options make use of a combination of AWS secure services and enterprise-grade encryption to protect the control messages and meta-data sent between the Elastio cloud connector that resides in the AWS account and the AWS console. Commands from the tenant and meta-data about Elastio operation in your AWS account are always encrypted in transit. Your backup data never leaves your account and is never accessible by the cloud connector or personnel.
Elastio secures user data in the user account, and data is never transferred to or accessible by Elastio. The data is encrypted at rest using Amazon KMS keys and in-flight and can be air-gapped in a separate account for additional isolation. Data is stored with AWS’s AES256 encryption.
Elastio uses a lightweight command-and-control channel between our SaaS and customer AWS accounts, built on AWS SQS queues and Lambda functions. The service requires access to specific AWS APIs, but this can be accomplished via PrivateLink if the VPC is isolated from the Internet. As part of our service deployment, the customer grants an Elastio-controlled tenant-specific IAM role the permissions Elastio needs to deploy the service, read from these queues, and invoke these lambdas. You can monitor the activity on these resources and can be assured that only the specific operations granted to our IAM role will be performed. There is never an IP network link between Elastio and the customer’s VPCs; all communication is via SQS messages and Lambda invocations. Clients will provide unique authentication credentials tied to our Role Based access in IAM. All communications are encrypted using the latest TLS protocols.
Each asset’s unique AES key is encrypted with the vault KMS key, so access to all of those per-asset keys is, in effect, controlled by access to the KMS key. Keys are never stored unencrypted; they are always encrypted in an AES envelope before storage.
Elastio enables S3 server-side encryption (SSE) as an additional layer of protection. All backup data is encrypted with a unique AES key per asset, on the client side, before being uploaded to S3. These keys are, in turn, protected by a per-vault key stored in the KMS, so only IAM roles with specific permission can access the KMS keys can decrypt data in the vault.
Because we use a unique AES key per asset, even a malicious client cannot use knowledge of one of these encryption keys to access backup data from another asset because the other asset uses a different key.
The Elastio service is self-sufficient and, once set up, does not depend on the tenant to perform backups and restores of any type, ransomware and malware scanning, or backup scheduling. This means an Elastio SaaS outage doesn’t stop scheduled backups. Nor does it stop the ransomware and malware scans. Customers can restore from backups in the event of an Elastio SaaS outage as well.
The Elastio Platform regularly looks to mitigate the potential of compromise. Elastio routinely scans our code, systems, and platforms for vulnerabilities using internal and external/third-party resources. Results and certification reports are available upon request and under NDA.
|
Name
|
Purpose
|
Entity Country
|
|---|---|---|
|
Intercom
|
Support, informational emails
|
US
|
|
Amazon Web Services
|
Cloud service provider
|
US
|
|
Hubspot
|
Marketing emails
|
US
|
|
Sendgrid
|
Transactional emails and alerts
|
US
|
|
Stripe
|
Self-serve account billing
|
US
|
|
Full Story
|
Digital experience monitoring
|
US
|
|
Auth0
|
User management
|
US
|
|
Mailgun
|
Email service
|
US
|
