Security by Design

Security requirements are incorporated at the design stage of every product feature and infrastructure component.

Privacy by Design

Data minimization, purpose limitation, and privacy impact are evaluated during product development.

Least Privilege Access

All access is restricted to the minimum required for a specific function and reviewed regularly.

Defense in Depth

Multiple independent security layers are applied at the network, application, data, and identity levels.

Continuous Monitoring

Production systems are monitored 24/7 for security events, anomalies, and availability.

Secure Development Lifecycle

Security reviews, dependency scanning, and vulnerability assessments are integrated into the software development pipeline.

3.1 Hosting

Engage is hosted on Amazon Web Services (AWS). AWS maintains SOC 1, SOC 2, SOC 3, ISO 27001, and PCI DSS Level 1 certifications for its data centres. Physical security is the responsibility of AWS. Customer data is logically isolated between tenants.

3.2 Network Security

• Virtual Private Cloud (VPC) with strict ingress and egress rules
• Network segmentation separating public-facing, application, and database tiers
• Web Application Firewall (WAF) on all public endpoints
• DDoS protection via Cloudflare (network and application layer)
• No direct public access to database or internal service tiers

3.3 Encryption

In Transit: All communications are encrypted using TLS 1.2 or higher (TLS 1.3 preferred). Supported cipher suites are reviewed annually and weak ciphers are disabled.

At Rest: Customer data is encrypted at rest using AES-256, including databases, object storage, and automated backups.

Key Management: Encryption keys are managed using AWS Key Management Service (KMS). Keys are rotated on a defined schedule and are not stored alongside the data they protect.

3.4 Backup and Disaster Recovery

Automated encrypted backups of all production databases are taken daily. Backups are retained for 30 days in geographically separate storage. Restoration procedures are tested quarterly. For current uptime, visit status.engage.nevtan.com.

4.1 Internal Access Controls

• MFA required for all production system access
• Role-Based Access Control (RBAC) — access granted by function, not by default
• Just-in-time access provisioning for elevated privileges with time-limited sessions
• All production access is logged, monitored, and subject to review
• Access revoked within one business day of role change or departure

4.2 Employee Security

• Background screening prior to production access
• Security awareness training at onboarding and annually thereafter
• Confidentiality and data protection obligations (contractual)
• Offboarding: immediate revocation of all access upon departure

5.1 Secure Development Lifecycle

• Security design review for all features involving data processing or authentication
• Peer code review required before any production deployment
• Automated static analysis and dependency vulnerability scanning on every commit
• Pre-deployment security testing including OWASP Top 10 validation

5.2 Vulnerability Management

• Automated vulnerability scanning on a weekly basis
• Remediation SLAs: Critical 24 hours; High 7 days; Medium 30 days
• Annual third-party penetration testing by an independent security firm
• Dependency and container image scanning integrated into CI/CD pipeline

5.3 Monitoring and Logging

• Centralized SIEM via Datadog with real-time alerting
• Application error and exception tracking via Sentry
• API request logging with rate limiting and anomaly detection
• Security-relevant log retention for a minimum of 12 months
• 24/7 on-call engineering coverage for security and availability alerts

Engage maintains a documented Incident Response Plan covering detection, triage, containment, investigation, remediation, recovery, and post-incident review.

6.1 Customer Notification

In the event of a Personal Data Breach, Engage notifies affected Account Owners within 48 hours of confirming the breach. Notifications include: the nature of the incident, categories of data affected, steps taken to contain and remediate, and recommended Customer actions. This timeline is designed to provide Customers subject to GDPR's 72-hour authority notification requirement with sufficient lead time.

• Trust Center: engage.nevtan.com/trust
• System Status: status.engage.nevtan.com
• Privacy Policy: engage.nevtan.com/legal/privacy
• Data Processing Agreement: engage.nevtan.com/legal/dpa
• Subprocessor List: engage.nevtan.com/legal/subprocessors
• Vulnerability Disclosure: security@engage.nevtan.com

9.1 Reporting

Report suspected vulnerabilities to security@engage.nevtan.com. Include: description and potential impact, steps to reproduce, affected URL or component, and contact information. PGP key available at engage.nevtan.com/security/pgp.

9.2 Safe Harbour

Engage will not pursue legal action against researchers who report in good faith, do not access Customer data beyond what is necessary to demonstrate a vulnerability, do not disrupt availability, and allow 90 days for coordinated disclosure.

9.3 Response SLAs

• Acknowledgement: within 2 business days
• Initial triage: within 5 business days
• Remediation timeline communicated: within 15 business days
• Critical severity: targeted remediation within 24–48 hours of confirmation

Security Team
Email: security@engage.nevtan.com