Annex 2: Security measures
These are the measures we apply under clause 6. They are also published at heyfixit.ai/legal/security.
1. Separation of customers
- Each customer's data is kept separate from every other customer's.
2. Access control
- Staff have access to Customer Data only where their role needs it, and only the access it needs.
- Multi-factor authentication protects every staff account that can reach production systems or Customer Data.
- Access is removed promptly when a person leaves or changes role.
3. Encryption
- Customer Data is encrypted at rest with AES-256 wherever our platform stores it, including backups.
- It travels over public networks, and between our platform and our Subprocessors' services, using TLS 1.2 or higher. Calls and texts also cross telephone and messaging networks that we and our Subprocessors do not control.
4. Backups and recovery
- Our databases have automated backups with point-in-time recovery. Other stores holding Customer Data are backed up or can be rebuilt.
- Backups are stored separately from the live data, across more than one data centre in the same region (the European Union, unless your Order Form names another region), and are kept for at most 35 days.
- We test restoring from backup before the Services first hold Customer Data, and periodically after that.
- Our recovery targets are to restore services within 12 hours, with no more than 12 hours of data lost.
5. Monitoring
- We monitor the platform, and its alerts reach a person, including out of hours.
6. Records of actions and changes
- The Services record the actions taken in your account and each change to Customer Data, Agent Instructions and permissions.
- Our cloud accounts keep audit logs of administrative actions.
7. Changes and testing
- Changes to the Services are reviewed and tested before they reach production.
- Test environments are separate from production and hold no live Customer Data.
- We scan our code's dependencies and our container images for known vulnerabilities.
8. Providers
- Before a provider processes Customer Personal Data, we check it and bind it by written data protection terms.
- Every provider is bound by written terms not to use Customer Data to train AI models, except to detect fraud and abuse of its own service where its terms allow it.
- The subprocessor list shows how long each provider keeps copies. Where a provider offers zero data retention on the plan we use, we use it.
9. Incidents
- A written incident procedure sets how we rate an incident, who decides and how and when we tell customers.
10. People
- Everyone with access to Customer Data is bound by a duty of confidentiality.