Security, data protection, and compliance at the enterprise level
Don't worry, your data is secure!
Yardstream is trusted by over 220 customers worldwide, and our information security team takes great care to protect our customers' data at all times. Yardstream values data integrity and confidentiality, and we have a zero-tolerance policy for any breach or violation. We pledge to provide the best customer experience possible by adhering to best practises in data security, data protection, infrastructure, and system availability.
Compliance and auditing
Yardstream is ISO 27001:2013 certified for security.
Yardstream audits its products, processes, and vendors to ensure that our information security is always improving. The audit findings are directly reported to the ISSG and are based on a systematic approach. The Information Security team monitors and reports on the resolution of audit findings until the audit is completed, if applicable.
Yardstream has SOC 2 Type I certification.
Yardstream has successfully implemented the SOC 2 Type 1 controls for process security, availability, and integrity. A SOC 2 report certifies that a service organization's controls are properly designed and implemented. The trust principle controls include process availability, confidentiality, security, privacy, and integrity. If you want to see the full report, please contact support@yardstream.live.
Policy on Privacy
Learn more about our company's privacy policies here.
Organizational and Technical Measures at Yardstream
Yardstream's technical and organisational security measures are as follows:
Cloud safety
Infrastructure protection
Yardstream 's services are hosted on the AWS virtual private cloud platform, which is highly secure, scalable, and ensures high data availability. AWS takes stringent security measures to safeguard its entire infrastructure. Yardstream’s infrastructure and data cannot be accessed by any third party or AWS itself. AWS data centres are ISO 27001, PCI DSS Service Provider Level 1 certified, and SOC 1 and 2 compliant. Learn more about AWS Compliance. We currently have a data centre in India.
Application and Network Security
In house security Team
Yardstream has an in-house security team that responds to any security issues or alerts.Yardstream has a dedicated team to handle any security issues or alerts.Our network monitoring team works around the clock to keep an eye out for any breaches or security threats. Any security breach is reported immediately, and our incident management procedure is followed to ensure a swift resolution.
Vulnerability Assessment and Penetration Testing, VAPT
Yardstream hires a third party to conduct vulnerability and penetration testing on its application and network. Reports can be obtained upon request. We use a third party to perform VAPT on our infrastructure network and applications. Please see below for the most recent network and application VAPT certificates.
Incident & Breach management
YardStream has defined an incident management process to classify and handle any incidents and security breaches. The Information Security team is responsible for monitoring, reporting, tracking, resolving, and communicating incidents to appropriate parties in a timely manner.
DOS and DDOS Protection
To counter DDOS attacks, Yardstream uses Cloudflare and several AWS services. Yardstream mitigates DDoS risks across all of its services by utilising Cloudflare CDN and AWS WAF.
Additional Security Measures
To ensure data protection and privacy, security regulations such as Incident Management, Access Control, Vendor Management, Change Management, Risk Management, Secure Software Development, Human Resource Security Procedures, Business Continuity Management, and so on are implemented.
Encryption of data
Yardstream never stores user passwords in plain text; instead, they are encrypted using the mechanism described below. At-rest encryption: At rest, all data is encrypted using the AES 256 standard. FIPS 140-2 compliant Hardware Security Modules are used to manage encryption keys. Yardstream uses the WebRTC standard for audio/video communication, which is encrypted in transit. All WebRTC data is encrypted in transit using standard AES (Advanced Encryption Standard) encryption, the SRTP default cypher (Secure Real-Time Transport Protocol).SRTP is a security extension for the network protocol designed for multimedia telephony, and DTLS (Datagram Transport Layer Security) is a secure communication protocol that prevents eavesdropping, modification, replaying, and other datagram security attacks.Aside from that, media streams are encrypted with aes-128-xts mode. [Depending on configuration, aes-256-xts and aes-128-ecb can also be supported].
Protocols
For all client-server communications, Yardstream employs the HTTPS and WSS (SSL/TLS) protocols.
TLS 1.2 and later protocols
Check ELBSecurityPolicy-TLS-1-2-Ext-2018-06 for a list of supported Key Exchange algorithms and Ciphers by clicking here.
Continuity and availability
Uptime
Yardstream services are deployed in multiple data centres for high availability and can automatically scale up to handle traffic.
Disaster Relief
Yardstream has a formal Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) in place to support people and processes in the event of a crisis or business interruption. Yardstream follows Disaster Recovery protocols that are compliant with ISO 27001:2013. In the event of a major outage, the company can restore availability by recovering all data from backups and moving services to a different DC/region. To improve our response practises, we hold disaster recovery mock drills on a regular basis. All production data is backed up every day, and our systems support point-in-time recovery. To ensure high availability, our services and data are replicated across multiple datacentres
Segregation of the Environment
The production environment at Yardstream is logically separated from all other environments and thus isolated. In our test environments, we never use production data.
Program for Information Security
Yardstream maintains a repository of information security policies. These policies are logically implemented, and all Yardstream employees are made aware of them during orientation.
Background Checks on Employees
Prior to employment, all Yardstream Global employees are subjected to a background and criminal check.
Agreements on Confidentiality
All Yardstream India and Global employees must sign Employment Agreements that include nondisclosure and confidentiality clauses.