Security
Due to the sensitive data processed in our software, fruiStrategy has implemented processes to maintain the security of customer and user data. Below are the key security processes.
fruiStrategy is delivered as a cloud software-as-a-service (SaaS) solution. fruiStrategy employees conduct all software maintenance and configuration, using industry-standard security controls such as firewalls, intrusion detection and change management.
A distributed architecture for data collection and processing scales horizontally as clients and traffic grow. Multiple monitoring tools track network resources, operating systems, applications and capacity, and systems scale up when predetermined capacity thresholds are reached.
Business continuity planning practices help management identify and manage risks that could affect reliable service to clients, start the right mitigation measures, and monitor risk and remediation activities.
All new employees, full time and temporary, receive general information security training at onboarding, plus a compulsory annual security and privacy refresher. Employees who handle client data receive additional security training.
Critical, repeatable processes and security checks in production are documented as procedures or automated with scripts. Formal change management tracks and documents every production change (network, systems, platform, application, configuration and physical moves), with Support, Engineering, DevOps and Security represented at regular change meetings.
Scheduled and emergency changes are tested in separate environments, then reviewed and approved by Engineering and Technical Support before deployment to production. Testing, other than deployment validation, is prohibited in the production environment.
An agile development methodology with iterative, rapid releases. Security and security testing run through the whole development lifecycle, Quality Assurance is involved at each phase, and security best practices are mandatory in all development activities.
Business continuity planning (BCP) and disaster recovery (DR) prioritize the critical functions that deliver fruiStrategy to clients. Their scope in each business function reflects how critical that function or facility is, to maximize effectiveness.
Customer data in the application is encrypted in transit over public networks using Transport Layer Security (TLS / HTTPS). Data that clients provide within the application is stored using industry-standard AES-256 encryption at rest.