AppFolio Inc

Security isn't a single yes/no, but AppFolio Inc is SOC 2 Type II compliant and holds SOC 2 Type II, PCI DSS. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

AppFolio Inc hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@appfolioinvestmentmanagement.com or via a /security page (AppFolio Inc lists a security contact).

AppFolio Inc's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.

AppFolio Inc's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

AppFolio Inc's trust center is at https://trust.appfolioinvestmentmanagement.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

All customer data in datastores, along with S3 buckets, is encrypted at rest. For sensitive collections and tables containing PII information like TINs, row-level encryption is implemented. This ensures that data is encrypted before reaching the database, rendering both physical and logical access insufficient to access the most sensitive information. AppFolio Investment Manager utilizes TLS for data transmission, incorporating features like HSTS (HTTP Strict Transport Security) to enhance the security of data in transit. AWS manages server TLS keys and certificates, deploying them via Application Load Balancers.

AppFolio Investment Manager has a multi-location strategy for production environments employed to permit the resumption of operations at other company data centers in the event of loss of a facility. We specifically utilize AWS US-based regions for storing live app data. Real-time replication ensures data redundancy in a secondary region. These data centers adhere to compliance standards such as HIPAA, ISO 27001, NIST 800-53/FISMA, PCI DSS, SOC1 Type2, and SOC2 Type 2. Strict access controls are in place and subject to regular reviews as part of our annual SOC2 compliance.

Absolutely. Active customer application data undergoes nightly backups stored to our AWS US-based data centers, ensuring ready access for 30 days in the event of Disaster Recovery. Backups are then transferred to durable storage mediums for archival purposes, where it is retained for a period of 7 years.

AppFolio Investment Manager utilizes AWS for provisioning US-based data centers across multiple locations. Each region is equipped with multiple availability zones featuring redundant power, networking, and connectivity. Operating within AWS's regions allows us to provide services that are highly available, fault-tolerant and scalable. As an illustration, in the event of an outage with S3 (utilized for document storage), a specific zone seamlessly switches to a redundant location within that zone. Complete outages impacting an entire AWS region are very rare and require manual attention and time to address. In such a situation, and depending on the incident's nature, our approach entails utilizing the aforementioned replication and retention controls in alternative regions to restore service. In accordance with our SOC 2 compliance controls, we conduct annual reviews of our Continuity and Disaster Recovery plans. Furthermore, per our previous SOC 2 audit reports, it's noteworthy that no significant incidents have occurred concerning the services provided to our user entities.

AppFolio Investment Manager collaborates annually with our testing partner, HackerOne, to perform a comprehensive assessment of system vulnerabilities. These assessments cover all aspects of the AppFolio Investment Manager product and cloud infrastructure, with full access to source code provided to testers for optimal effectiveness and coverage.