This page describes JanusKS-hosted deployments. In private cloud, on-premises and air-gapped deployments, the hosting and infrastructure controls below are replaced by your own environment and controls.
JanusKS' primary security focus is to safeguard customers’ data. As such, we have designed and implemented controls to protect and service our customers.
Our objectives are:
- Provide trust and protection by delivering world-class products and services while protecting the privacy and confidentiality of customer data.
- Ensure the availability of JanusKS Decision Support Systems, including Projectal, and minimize risks to service continuity.
- Ensure that customer data is never modified inappropriately.
Infrastructure Security Controls
JanusKS does not host any Decision Support Systems or data within its corporate offices. All Decision Support Systems and infrastructure data are stored on Amazon Web Services (AWS).
We rely on AWS's audited security and compliance programs for the effectiveness of their physical, environmental, and infrastructure security controls. AWS guarantees between 99.95% and 100% service availability, ensuring redundancy to all power, network, and HVAC services. The business continuity and disaster recovery plans for the AWS services we use have been independently validated as part of their SOC 2 Type 2 report and ISO 27001 certification.
For more information, AWS’s compliance documentation and audit reports are publicly available at the AWS Cloud Compliance Page and the AWS Artifacts Portal.
Network Security Controls
JanusKS product infrastructure uses multiple layers of filtering and inspection on all connections across our web application firewall (WAF), logical firewalls and security groups.
Network-level access control lists are in place to prevent unauthorized access to our internal product infrastructure. Firewalls are configured to deny network connections that are not explicitly authorized.
Network security is actively monitored and controlled using AWS monitoring and configuration systems. Firewall rulesets are reviewed on an annual basis.
Configuration Management Controls
JanusKS uses automated scripts and images to maintain our infrastructure and to scale services to meet the needs of customers. We can expand the capacity of our infrastructure when needed. All server configurations are contained in images and configuration files, which are used when new server instances are required. Patches are handled using automated configuration management tools.
Logging Controls
Actions and events that occur within JanusKS Decision Support Systems are logged. These logs are stored on AWS storage for monitoring and analysis by the JanusKS support team.
Alert Controls
JanusKS infrastructure is configured with alerts that notify the JanusKS support team of issues such as serious errors, downtime, and other anomalies. We are continually adding more alerts to ensure faster and more granular responses.
DNS Security Controls
All JanusKS Decision Support System instances have separate DNS entries and these DNS entries are maintained at the JanusKS DNS registrar. Access to the registrar console is limited to selected JanusKS staff and requires device validation and Multi-Factor Authentication (MFA).
Web Application Security Controls
All customer data hosted within their JanusKS Decision Support System instance is protected by a Web Application Firewall (WAF). A WAF actively monitors real-time traffic and alerts or denies malicious behavior based on behavior type and session rate.
Development and Deployment Controls
JanusKS Decision Support Systems are constantly improved with new features, enhancements and bug fixes. The software development team have a consistent approach that is followed for development, testing and deployment. Newly developed code has code reviews and static code analysis. Unit tests are added to ensure correct operation of code. System testing is performed at multiple stages before reaching customers. Deployments to customers are tested and analyzed to ensure correct installation and operation. New version information is communicated to customers directly.
Vulnerability Controls
We use a variety of industry-recognized tools to check for vulnerabilities across all aspects of our JanusKS technology.
External industry recognized cyber security vendors perform penetration tests against our applications. Their findings are assessed and all serious issues are fixed as a high priority. Final reports are available to our customers.
Encryption Controls
All data stored at-rest in JanusKS Decision Support Systems is encrypted. All data transmitted with JanusKS Decision Support Systems is encrypted with TLS version 1.2, or 1.3 and 2,048 bit keys or better.
Key Management Controls
Encryption keys for both in transit and at rest encryption are securely managed by the JanusKS infrastructure on AWS. Keys managed by JanusKS are rotated at varying frequencies, depending upon the sensitivity of the data they govern. Customers who use customer-managed keys hold those keys in their own key vault. TLS certificates are renewed annually.
Backup Controls
By default, all JanusKS Decision Support System instances have their data backed up on a daily basis. JanusKS infrastructure is backed up on a regular basis using automated schedules. 30 days of backups are retained for customer data restoration purposes. Deleted data may remain in backups for up to 60 days, as described in our Privacy Policy. Backups are stored on regional AWS storage and copied periodically to a separate AWS region for recovery in the event of a primary regional outage. Restoration of data is available to customers following a request to the JanusKS support team.
User Permission Controls
JanusKS Decision Support Systems contain comprehensive permission and access policy features that empower customers to create and manage access policies for the use of those systems. Customers can selectively restrict access to features, data fields and data instances to control the behavior of their users.
Login Authentication Controls
JanusKS Decision Support Systems allow users to login using either the native login or with Single Sign On (SSO).
The native login enforces a uniform password policy. This can be configured by the JanusKS support team to match customer authentication requirements. Both SAML-based SSO authentication using any SAML-based IDP is available, and SSO authentication using LDAP or Active Directory (AD) is available.
Two-factor authentication can be set using SSO authentication.
API Controls
JanusKS Decision Support Systems provide an Application Programming Interface (API) that enables software developers to gain access to features and data in those systems. The authentication and use of the API for software developers is controlled by the login authentication controls and user permission controls.
Employee Access Controls
Selected JanusKS employees are permitted to access JanusKS infrastructure using its company network or Virtual Private Network (VPN), which requires device validation and Multi-Factor Authentication (MFA).
The JanusKS support team access customers' instances to provide support assistance when customers provide login access to their instance to the JanusKS support team, and customers can deny that access at any time. A subset of employees may also access products and customer data through controlled, logged interfaces, as set out in Schedule 2 of our Data Processing Agreement. Customers can use access policies and permissions to restrict access to selected features and data.
Corporate Authentication Controls
JanusKS employees require device validation and MFA when accessing the JanusKS corporate network. Password policies follow industry best practices for required length, complexity, and rotation frequency. Password vaults are in place to manage certain administrative account passwords.
Policy Document Controls
JanusKS maintains a set of internal policy documents in our corporate wiki that JanusKS employees can access to understand all policies. The policies are reviewed annually.
Building Security Controls
At JanusKS' head office, the building and office are secured with controlled access and a monitored security alarm. When employees are no longer employed by the company, their access is removed.