Security standards

Overview

This document outlines HighCohesion's comprehensive security practices and technical standards. It provides detailed information about how we protect your data, manage access, and maintain our infrastructure to ensure the highest levels of security and compliance.

Data security and classification

We store three types of data, all accessible only from within our Private Network:

• Configuration data: Stored in AWS RDS instances

• Transaction information: Stored in MongoDB Atlas instances

• System keys and customer data: Order and product files stored in private Amazon S3 buckets

All data is encrypted at rest using server-side encryption (SSE) with AES-256 keys.

Personal Account Information

Personal details you provide when creating a HighCohesion account, such as your name and email address, are stored for as long as your account remains active. You can request account deletion at any time, and this data will be removed from our systems.

Personally Identifiable Information (PII)

We use a number of different tools to help us track usage of the product such as raw server logs. These tools may receive personally identifiable information such as your computers IP address and in some cases your name and/or email address. Raw server logs are not stored for more than 14 days and, inline with GDPR you can request any PII that we store, to be removed from our systems and any sub processors we employ.

Authentication Data

To enable workflows to process data between third-party services on your behalf, we require you to provide authentication credentials such as usernames, passwords, and access tokens. This sensitive authentication data is encrypted at rest in our databases using strong 256-bit encryption and will be removed when you delete your HighCohesion account. All sensitive authentication data is obfuscated when passed through Stream execution state and logs. Only HighCohesion admin users have access to this information. We can share this information with customers or partners only under a support request at support@highcohesion.com.

Stream Data

We store stateful data as part of the integration execution process for post-execution logging, Root Cause Analysis (RCA), and error resolution. We retain detailed execution data and log information only as long as necessary. Stream log data viewable by customers in the "Logs" view of each stream is stored for 14 days before deletion. Stream execution data, including payload in, payload out, and transformation files, is stored for 60 days before being erased. Designated HighCohesion and partner staff can access this data when needed for their role.

Identity and access control

Control Panel accounts are set up via sponsorship: a new account must be requested and sponsored by an existing user within the same organisation. Only business email addresses are accepted; personal email accounts (e.g. Gmail, Outlook, Yahoo) are not permitted. To access our platform for the first time, request it via direct email or by creating a support ticket at support@highcohesion.com. Our support team will review and approve your request, then create an account under your organization. You'll receive a one-time login link via email. After clicking that link, you must set a new password and configure MFA.

All users have MFA enforced, including admins.

Passwords are encrypted using best-in-class encryption algorithms with up to 448-bit keys. Sessions last 10 hours to maintain a fresh login cache. After the cache expires, users must log in again by entering their username and password, followed by the MFA flow.

Starting 1st April each year, we perform a Control Panel account review. Any user with no login activity in the previous 60 days is removed.

User roles and permissions

HighCohesion uses three permission roles for individual organisations: Owners, Editors and View-only Users. An Owner is eligible to access all features necessary to configure and setup a Stream, such as System Keys, Source, Transformation and Destination functions. Additionally an Owner is eligible to create, edit and revoke users within their own Organisation. A View-only User is solely eligible to view system configurations and Event/Job reporting to safely access the Control Panel, without the risk of making unwanted edits to the live environment.

To ensure data segregation, data for a particular Organisation is accessible only by a unique Organisation ID. Data is passed by first authenticating as the Organisation, thus giving access only to data related to that specific Organisation.

Architecture and hosting

All HighCohesion services are hosted in physically secure, private data centers managed by AWS in eu-west-1 (Dublin).

HighCohesion provides two complete environments: a test environment for validating integrations and running UAT tests, and a live environment.

Servers are protected by a private network with inbound restrictions.

Internal services are accessible only within our private VPN.

Logging, monitoring and alerting.

All user activity on the platform is logged, including actions taken, data modified, and timestamps.

We also log every access to our platform, recording the time, IP address, and machine name from which the request originated.

All logs are stored for 14 days in our internal logging system. Only internal team members have access to this service.

We monitor all services 24/7.

Alerts are caught internally and customers are notified via email.

Network security

All customer and partner connections to the HighCohesion platform are encrypted using TLS 1.2+ protocol or SFTP (SSH) for secure data transmission.

Data Encryption in transit is optional when SFTP is used in combination with PGP encrypt/decrypt protocol.

Our VPN is restricted to HighCohesion employees only.

Database access is never exposed publicly.

All resources are deployed within private subnets with network-level isolation, and cross-zone load balancing is enabled with load balancers for high availability without public exposure.

Incident Response

For more information about incident management, see our Disaster Recovery plan.