Security as a company value
Our security and compliance principles guide how we build and run Tribyl, so your data stays protected.
Secure personnel
Only vetted people get access to our data and our customers’ data.
Every employee and contractor has a background check before joining, in line with local laws and industry practice.
Everyone with access to sensitive or internal information signs a confidentiality or non-disclosure agreement.
Security is part of how we work: we train and test our people on current and emerging attack techniques.
Secure development
Security is designed in from the start.
All development at Tribyl follows secure development lifecycle principles.
New products, tools and services, and major changes to existing ones, go through a design review to make sure security requirements are built in.
Engineers complete secure development training every year in the languages they work with.
We build to the OWASP Top 10 recommendations for web application security.
Secure testing
Independent testers check our work regularly.
Third parties run penetration tests and vulnerability scans on all production and internet-facing systems on a regular basis.
Every new system and service is scanned before it goes into production.
Internal security engineers and external testers both test new systems and major changes, for a real-world view from more than one angle.
All code, including open-source libraries, goes through static and dynamic security testing as part of development.
Cloud security
Every customer is fully isolated in a modern multi-tenant cloud.
Tribyl runs on Amazon Web Services (AWS) and uses its native physical and network security. AWS maintains the infrastructure, services and physical access controls.
Each customer’s environment and data sit in a dedicated trust zone, so nothing can be mixed between customers by accident or on purpose.
Data is encrypted at rest and in transit, with unique encryption keys that keep each customer’s data separate from every other customer’s and from ours.
Access is role-based and follows least privilege. We review access regularly and revoke it as needed.
The platform is monitored continuously.
AI and data processing
Clear terms for how your data is used.
How we process customer data, including with AI models, is set out in our data processing agreement, which is part of every customer contract.
SOC 2 Type II
Independent audits give you assurance that our security controls work as described.
Tribyl has completed the AICPA SOC 2 Type II audit and received an unqualified opinion, confirming that our security practices, policies, procedures and operations meet SOC 2 standards. The audit was carried out by Prescient Assurance, a registered public accounting firm in the US and Canada.
