Security and compliance

Security of the CentricMinds solution, and your data, is our highest priority. This is evident through:

Secure Access: All access to CentricMinds is through HTTPS (e.g. use of Secure Sockets Layer (SSL)/Transport Layer Security (TLS) to protect data in transit).

Security Standards: CentricMinds employs/applies standards provided by the Open Web Application Security Project (www.owasp.org). This includes the use of their filters/tools to provide a secure solution/hosting environment. As an example, the OWASP CSRFGuard is used to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks.

Security Testing: CentricMinds performs ongoing and rigorous penetration testing to validate the security of our solution. This includes effort throughout the product development process as well as the use of independent testers to perform penetration testing in areas such as Access Control, Data Validation, Password Policies, Cross Site Scripting, SQL Injection, Cryptography, Data Storage etc.

Data Separation: CentricMinds completely separates your data from other customers. There is no risk of cross customer data access.

Granular Access Control: CentricMinds provides a granular group/role-based resource security model with the ability to define view and/or edit permissions on individual resources. This provides great flexibility in securing your data and only allowing access to those that should have the ability to do so.

Version Control / Audit History: CentricMinds provides full version control and audit history logging. All changes are logged, and a full revision/audit history is maintained. Authors have the ability to:

• View a detailed version history of each individual resource/content,
• Compare versions of resources/content,
• Rollback to previous versions of resources/content

Secure Sharing: CentricMinds provides the ability to securely share resources (including files) with external parties. This includes:

• Password-protected access: Ability to create and manage user accounts for use by external parties to allow users to login and access designated resources (include files and/or folders).
• Time-limited secure access links: Ability to share a resource with someone via a secure time-limited link without that person needing a user account / login.