Security at Progression

Last updated: 22 June 2020

Application security is always top of mind at Progression. We have put in place extensive proccesses, best practices and system design choices to ensure that Progression is a resilient and reliable platform.

Below we provide more information on specific security practices.

Infrastructure security

Hosting

Progression is hosted on world class infrastructure at Heroku.

Heroku is a cloud application platform used by organizations of all sizes to deploy and operate applications throughout the world. Heroku’s platform provides infrastructure management, scaling, and security.

Heroku applies security best practices and manages platform security, protecting customers from threats. Heroku applies security controls at every layer from physical to application, isolating applications and data, and rapidly deploys security updates without customer interaction or service interruption.

More information can be found at Heroku’s security policy.

Heroku utilises ISO 27001 and FISMA certified data centres managed by Amazon. Information about security at Amazon data centres is available here.

Encryption

Data is encrypted over HTTPS using Transport Layer Security (TLS v1.2) protocols with minimum 128-bit keys and using SHA256 certificates, meaning that our users always have a secure connection from their browsers to our service.

Data is encrypted at rest with AES-256, block-level storage encryption as part of the service provided by Heroku.

Database backups are GPG encrypted and stored in an encrypted AWS S3 bucket.

Operations

Vulnerability scanning. We regularly make use vulnerability scanning and static code analysis to scan for vulnerabilities. Our engineers respond to issues raised.

Brute force prevention. We employ password strength requirements, Cross-Site Request Forgery (CSRF) protection, secure password reset practices, and log in attempt rate limiting with automated account lockout. Suspicious behaviour is responded to by rate limiting and blocking IP addresses.

Backups & monitoring. We use Heroku managed database backups which allow us to rollback to any point in the last four days. Nightly backups, stored on AWS S3, are carried out automatically and retained for 90 days.

Incident response. We maintain a 24 / 7 on-call rotation and escalation policy, with production alerts captured and automatically escalated.

People process. Only employees with the necessary rights and roles have pre-authorised access to our underlying data. Access is unique, logged and uses strong password policies managed through an enterprise password manager, coupled with two-factor authentication, where appropriate.

Product security

Authentication and authorisation

Roles & Permissions. Access to customer data within each organisation is controlled with a sophisticated set of roles and permissions built on top of industry standard, open source packages. Roles and permissions are underpinned with a suite of automated tests to ensure correct authorisation.

Secure passwords. We enforce a minimum password length to encourage users to pick more secure passwords.

SSO via Google. Users can authenticate in one click using their Google account. They’ll never need to set a password with us to log in to their account or to sign up, even if they’re creating a new account.

Compliance

GDPR. At Progression privacy, security and transparency are the heart of how we think about our product and company, read more about our GDPR compliance.

PCI DSS. All payments are handled by our payments provider, Stripe.