Security Posture Statement

1. Infrastructure Security

• Our core infrastructure providers, including DigitalOcean, Vercel, Zoho Billing, and Razorpay, maintain industry-recognized certifications and compliance attestation such as PCI DSS, SOC 2, and ISO 27001 based on the services they provide.
• Getivity relies on these vendors for the security certificates and audited controls that underpin our operational security.
• Data is hosted in secure, geographically distributed cloud data centers with network security protections including firewalls, DDoS mitigation, and redundancy.
• Backup and disaster recovery procedures ensure data retention and availability with encrypted backups and timely restoration capabilities.

2. Access and Identity Management

• User access is controlled through Firebase identity management system with strong authentication measures.
• Role-based access control and periodic access reviews minimize unnecessary privileges.
• Password policies and secure credential storage reduce the risk of unauthorized access.

3. Secure Communications and Data Encryption

• All data transmitted between users and Getivity is secured via TLS/SSL encryption, ensuring secure connections and data privacy during transit.
• Getivity enforces HTTPS across all web interfaces with automatic redirection from HTTP to HTTPS to guarantee encrypted communication.
• Data stored within our databases and backups is encrypted at rest utilizing strong encryption standards aligned with industry best practices.
• We implement Perfect Forward Secrecy (PFS) and up-to-date cipher suites to strengthen session security.

4. Application and Data Security

• Sensitive data is encrypted with access controls strictly enforced based on principle of least privilege.
• Regular patching, vulnerability scans, and secure coding guidelines reduce threats from application vulnerabilities.

5. Monitoring and Incident Response

• Continuous monitoring of infrastructure and application logs for anomalies and security events.
• Documented incident response procedures coordinate timely detection, containment, and recovery.
• Collaboration with infrastructure providers ensures coordinated response to critical incidents.

6. Vendor Risk Management

• Evaluation and ongoing monitoring of vendors’ security posture and certifications.
• Contractual commitment to data confidentiality and compliance with applicable laws.

7. Data Residency and User Control

• During the signup process, Getivity workspace creators select their preferred data residency region (e.g., India, European Union, or United States).
• Based on this selection, customer data, backups, and processing are hosted in secure data centers located within the chosen jurisdiction to meet data sovereignty and compliance requirements.
• Our architecture ensures that users are served from their nearest regional edge servers to optimize latency and comply with residency preferences.
• We maintain strict controls over data handling and cross-border data transfers, applying appropriate safeguards according to applicable laws and regulations.

8. Security Awareness and Training

Getivity ensures that all team members involved in platform operation and support undergo regular security awareness training. This training focuses on information security best practices, recognizing potential threats, and the importance of safeguarding customer data. Our commitment to ongoing education fosters a security-conscious culture within our team.

9. Privacy Practices

We are committed to respecting the privacy of our customers and comply with applicable data protection laws.

Our privacy practices ensure that personal data is collected, processed, and stored only for legitimate business purposes. Customers can review our detailed Privacy Policy, which explains data usage, retention, and user rights.

10. Data Retention Policy

Backups of customer data are performed regularly and stored securely with encryption. Our standard backup retention period is 7 days through cloud provider backups, with options for extended retention managed through additional backup configurations. Application and system logs are retained according to operational and compliance requirements to support auditing and troubleshooting.

11. Backup Verification & Testing

Our backup processes are not only automated but also regularly tested to confirm their reliability and effectiveness. Periodic restoration drills and backup integrity checks validate that customer data can be recovered promptly and accurately in the event of data loss or disruption.

12. Change Management and Patch Management

Changes to Getivity’s software and infrastructure are managed through a formal change management process. Security patches and updates are applied promptly following testing to minimize vulnerabilities. This disciplined approach helps maintain platform security and stability while mitigating risks from emerging threats.

13. Customer Responsibility

While Getivity provides a secure platform, customers also play a crucial role in maintaining security. Users are encouraged to adopt strong, unique passwords, safeguard their login credentials, and promptly report any suspicious activity. Adhering to recommended security practices enhances the overall protection of accounts and data.

14. Transparency and Reporting

We value transparency and provide customers with timely updates regarding security matters relevant to Getivity. In the unlikely event of a data breach or incident impacting service security, we follow a structured notification and response protocol aligned with legal and regulatory requirements.

15. Responsible Security Disclosure

Getivity values responsible security research and encourages customers and researchers to report potential security vulnerabilities. We have established a coordinated disclosure process to handle such reports efficiently and confidentially. Please report any security issues by contacting contact@getivity.com with detailed information. While we do not currently offer a formal bug bounty program, we appreciate responsible disclosures and may offer rewards based on the impact of findings.

For detailed inquiries about our security controls, please contact contact@getivity.com.