Exalate

Security isn't a single yes/no, but Exalate is SOC 2 compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Exalate hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@exalate.com or via a /security page (Exalate lists a security contact).

Exalate lists 5 subprocessors on its trust center, including Google LLC, rsync.net, Inc., Hubspot, Inc., OpenAI, Datacenter United. Buyers use this for fourth-party risk review.

Exalate's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Exalate publishes a DPA on its trust center. You can request access through SOC2C.

Exalate's trust center is at https://trust.exalate.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

At Exalate we base our security approach on three dimensions: - Security by Design Security vulnerability scanning has been implemented at every stage of the development, deployment, and operation of the solution. This scanning is based on the solutions provided by Aikido, which allow highlighting the security problems from the moment a developer types a line of code. - Advanced Endpoint detection and response (EDR) monitored by a 24/7 SOC EDR is implemented through a combination of the Palo Alto Cortex XDR solution, a 24/7 manned SOC for addressing incidents and vulnerabilities, and the Security Command Center to guard the Exalate cloud environment. - Process and policies focused on increasing the security awareness of the whole team All policies related to the ISO27001 standard have been implemented and are controlled by various processes. Roles and responsibilities are defined and assigned to various people in the team. These policies include: - Acceptable use - Privacy and Employee privacy - Security awareness training for all the employees - HR recruitment - The Incident, Vulnerability, and Change management - Risk management While we can address the specific security concerns customers might have based on their use cases, the following is a list of the most commonly asked questions.

Exalate is ISO27001:2022 certified. This means that all the conditions for achieving this certification have been implemented. Evidence of the auditing process and the certificate can be provided upon request.

As part of our ongoing improvements to our security program, we will soon proceed with the SOC2 certification.

Exalate has its HQ in Europe (Belgium) and therefore complies with all GDPR-related legislation.

A single-tenant application, in the context of integration software, is an application that is related to only one system. A multi-tenant application on the other hand allows using one infrastructure to connect with multiple systems. So, whenever considering an integration solution, one should pay attention to the tenancy of the proposition. All software has bugs, either because of improper development, configuration mistakes, or any other reason. The recent breaches at LastPass and Octa show that protecting information is a Herculean task. Integration software is more complex as it needs to take care of many diverse aspects and information paths. To minimize the risk of information leakage, a single-tenant architecture is a much better option as it allows us to contain information leaks at the infrastructure level. When an Exalate node is deployed on the Exalate Cloud, it is running inside a ‘Kubernetes pod’ that is configured to ensure no information can leak. The maintenance of this Exalate Cloud is fully based on the principles of ‘Infrastructure as Code’. There is no manual configuration for the environment.

All clusters are protected by state-of-the-art Endpoint Detection and Response (EDR) systems, specifically the ‘Cortex MDR’, from Palo Alto. This infrastructure is monitored round-the-clock by a Security Operations Center (SOC) staffed by Cyber Security engineers. The monitoring service, provided by NVISO, has been validated by a MITRE ATT&CK test.

Atlassian requires that any 'add-on' technology runs on a separate server. This is called Atlassian Connect. Relevant data for the functioning of the add-on will be exchanged with the vendors' servers. The same applies to Exalate. Whenever an issue is updated, a webhook will be called. It triggers the Exalate logic to collect all relevant data such as specified in the outgoing sync processor (Sync Rules). This communication is secured via HTTPS and JWT. In case _the Destination side is on the private network_ the issue data resides on the Exalate Cloud servers until the destination Jira instance requests for any changes. These changes will then be sent to the Jira Server - and that communication is normally also secured via HTTPS. The information on the Exalate cloud server is removed. In case _the Destination side is publicly accessible_ the issue data resides on the Exalate Cloud server until the app filters and processes changes. These changes will then be sent to the Destination Jira Instance - and that communication is normally also secured via HTTPS. The information on the Exalate cloud server is removed. Contrary to the common implementation model as prescribed by Atlassian, Exalate cloud apps are single-tiered. Meaning - that the operation and handling of the data are fenced from any other interference.

Exalate performs authentication through the underlying platform (e.g. Jira). Whenever there is a need to log into the application, Exalate will check with the platform if the authenticated user is authorized to perform configuration tasks or not. The authentication protocol is either 'Basic Authentication' or 'Oauth' based. Since Exalate doesn’t have a user directory concept, there is no need for an SSO Solution integration.

Access to the application is defined by the underlying system and is fully configured by the administrator of that platform. When deployed on Exalate Cloud, our support engineers and cloud operators can have access to the data, but only after explicit approval by the customer. All our staff goes through background checks, and only a well-identified list of employees with appropriate clearances can access your information.

Access to the data processed by AI is strictly limited to authorized personnel. Additionally, access to logs and interactions with the AI feature is restricted and monitored to ensure compliance with security policies.

Any customer data in the Exalate cloud is encrypted in transit and at rest. Offline backups are encrypted for each tenant. Furthermore, Exalate Cloud ensures that every node is totally separated from any other node, including computing resources, file storage, database storage, and network path.

Exalate uses the Transport Layer Security (_TLS_) Protocol Version _1.3. If the issue tracker does not support this version, we use TLS 1.2._