Last updated: July 2021
Because Pave is a hosted Software-as-a-service product, we recognise that security is crucial. This page outlines our security and backup policies.
Our system integrates with Stripe, which is a PCI compliant payment processor. When entering credit card information, a request is made directly to Stripe using SSL.
Pave is built on the NodeJS platform and uses all the built-in protections for sanitising query parameters in SQL statements.
Data is hosted on Amazon EC2 and Amazon RDS with encryption enabled.
Pave runs two hot-hot server instances side by side with AWS meaning in the highly unlikely scenario there is a server outage, the back-up server is automatically enabled and there is no noticeable loss of service to any user of our applications. Each of AWS' server instances operate at a best-in-class “5 nines” or 99.999% uptime and availability. More can be read here;
All access to Pave is over a secure (SSL encrypted) connection.
All activity on a company is logged and is available in the “Audit Log” maintained for each company in the system.
All employees are required to sign a confidentiality agreement. Each employee is given a separate login to the system and all page requests are logged and backed up. Access to any identifiable information related to projects, contacts and deals is only available on the principle of least privilege and not available outside of the engineering team under any circumstances.
Backups are stored offsite and are encrypted. Pave performs daily, weekly, and monthly backups of the entire system. These backups are made to Amazon S3 which stores data in multiple facilities and on multiple devices within each facility. Amazon S3 performs regular, systematic data integrity checks.
Cookies are required for normal operation of Pave however, no PII is stored in any of the cookies that Pave uses.
For more information, you can reach our Privacy Officer / Data Protector Officer on firstname.lastname@example.org.