Security

Security

Cloud Security. Vendavo utilizes the top cloud providers with N+1 redundancy and broad range of audits and certifications. There is 24x7x365 managed physical and infrastructure security and strict access control measures. We apply HA architecture principles and align our deployment model with the provider recommended best practices. Customer data are regularly backed up and tested for restorability and our business continuity program is aligned with the international standard ISO 22301.

Portfolio Security. Vendavo adopts industry standard SaaS secure software lifecycle practices, including security design and code reviews, static and dynamic testing, vulnerability scanning and independent penetration tests. We apply stringent security measures including robust and widely recognized standards for encryption at rest and in transit, customer data segmentation controls in multi-tenant applications, and fine-grained and customizable RBAC/ABAC. User access supports SSO integration with customer identity management systems.

Operational Security. Customer workloads, critical company infrastructure and employee computers are protected by robust EDR/XDR solution with 24x7x365 Security Operations oversight. Vendavo applies system and infrastructure hardening procedures, network segmentation, perimeter defense including DDoS protection via firewalls, load balancers, and WAFs. We run regular internal and external vulnerability scans and implemented systematic patch management program. Privileged access entitlement is limited to key Operational personnel, subject to senior management approval and regularly reviewed.

Governance, Risk and Compliance. Our ISMS is built on top of international standard ISO 27001, we pass ISO and SOC 1, SOC 2 and SOC 3 Type II audits. We have aligned our practices with Cloud Security Alliance standards and published CAIQ self-assessment questionnaire. Our Security & Compliance Department drives the company ISMS, facilitates Risk Management program and oversees compliance across the company through regular internal audits and compliance reviews. Chaired by the CISO, Vendavo Security & Compliance Council, comprising from SLT members and key stakeholders from Customer Operations, IT, Legal, and Finance oversees the security program and key risks on bimonthly basis. Formal awareness program is in place for all employees and contractors with access to company systems and we run simulated adaptive phishing training.