1. Security program and governance
Our security program is owned by engineering leadership and reviewed regularly. Policies cover access control, change management, incident response, vendor risk, and business continuity, and every team member completes security training when they join and annually after that.
2. Infrastructure and network security
- Production runs on hardened, cloud-native infrastructure defined as code and deployed through reviewed pipelines.
- Zero-trust network segmentation isolates environments, services, and customer workloads; no service is trusted by network location alone.
- Production, staging, and development environments are strictly separated, and production data is never used in lower environments.
- Edge protection includes DDoS mitigation and a web application firewall.
3. Data protection
- In transit: all traffic is encrypted with TLS 1.2 or higher, with HSTS enforced on public endpoints.
- At rest: customer data is encrypted with AES-256, using managed key services with regular key rotation.
- Data residency: enterprise customers can choose regional hosting to meet data sovereignty requirements.
- Deletion: customer data is deleted or returned at the end of a contract, as set out in our Data Processing Agreement.
4. Identity and access management
- Single sign-on and phishing-resistant multi-factor authentication are required for all internal systems.
- Access follows least privilege, is granted per role, and is reviewed quarterly.
- Production access is just-in-time, time-limited, and fully logged.
- Access is revoked immediately when someone leaves the company.
5. Secure software development
Every product is engineered in-house by our permanent team, so we control the full development lifecycle:
- Mandatory peer code review before any change is merged.
- Automated static analysis, secret scanning, and dependency vulnerability scanning in CI.
- Threat modeling for new features that handle sensitive data.
6. Monitoring and incident response
We run continuous threat detection with centralized, tamper-resistant logging and on-call alerting around the clock. Our documented incident response plan is tested regularly. If a security incident affects customer data, we notify affected customers without undue delay, in line with our contractual and legal obligations.
7. Availability and business continuity
- Services are designed for high availability across multiple availability zones.
- Encrypted backups are taken automatically and restoration is tested regularly.
- Disaster recovery plans define recovery objectives for every critical service.
8. Vendor management
Third parties that process customer data are assessed for security and privacy before onboarding and reviewed periodically. They are bound by written agreements with data protection obligations. Our current sub-processors are listed in the Data Processing Agreement.
9. Privacy and compliance
We support our customers’ compliance with GDPR, UK GDPR, CCPA/CPRA, and regional data protection laws. See our Privacy Policy and Data Processing Agreement.
10. Responsible disclosure
If you believe you have found a security vulnerability in a Techriver product or website, please report it to [email protected]. Include enough detail for us to reproduce the issue.
- We will acknowledge your report within 3 business days and keep you informed of our progress.
- Please do not access, modify, or delete data that is not yours, degrade our services, or publicly disclose the issue before we have resolved it.
- We will not pursue legal action against researchers who act in good faith and follow these guidelines.