TeamConnect Cloud Services Security Overview

Introduction

The hosted Mitratech Cloud environment is supported by a dedicated team of IT, Security, Engineering, and Governance, Risk and Compliance professionals. The Mitratech Cloud Services and Security teams take a coordinated and collaborative approach to security, focusing on guiding and implementing both technical and procedural security solutions.

This document is meant to provide a general overview of the hosted TeamConnect Platform and Mitratech’s Information Security policies and practices.

Data Ownership and Scope

Before getting into the specific security services and processes that Mitratech employs, it is important to clearly define ownership and scope. Client instances are deployed on the TeamConnect Platform. Feature security settings, access control, end user maintenance, etc. at the client instance level are ultimately the responsibility of the client. When it comes to the Platforms, Mitratech actively monitors and manages the environment, implementing solutions to help enhance security.

Mitratech Cloud Services follow industry standards and best practices when providing the computer and application resources that host the various client environments. While Mitratech manages the cloud infrastructure, including the compute resources, it is the client that ultimately is in control of application behavior, such as end-user management, application features and settings, etc.

General Security

Below is a list of general security functions that Mitratech supports or implements as part of the Mitratech Platform:

Access Control

Reminder: Customers are responsible for user level security/access control at the client application level.

Mitratech’s access control policy applies to systems which are managed and maintained by Mitratech (i.e. The Platform). Our internal access entitlements are reviewed and updated by Cloud Services on a quarterly basis. The Mitratech access control policy addresses control processes including, but not limited to:

• User identification

• Account provisioning processes

• User account authentication

• Password requirements

• User account security settings

• Privileged user access management

• Access recertifications

• Segregation of duties

The Mitratech Cloud Services environment is completely isolated from the Mitratech Corporate data center environment by way of geographical, physical, and network separation. All employees are restricted from physically accessing any hosting system. Employees with a sensitive data access requirement can be granted temporary, or read-only access for the purpose of diagnosing client problems. Examples of employee roles granted this limited, read-only access are: Tier 3 Support Engineers and Cloud Services Application Administrators. These privileged roles can only access the Cloud environment through select bastion host environments. Once they have terminal access to the environment, they can initiate an additional terminal access to the appropriate virtual machine or server. Additionally, Mitratech Cloud Services has created extensive policies, standards & guidelines along with security training for all employees with access to the data center environment. More information about Access Control is available in Mitratech’s annual SOC2 Type 2 report. 

Change Management

Mitratech's change management policy applies to systems which are managed and maintained by Mitratech Cloud Services. The policy is reviewed and updated by the Cloud Services and Security Operations teams on a regular basis. Mitratech change management encompasses processes including, but not limited to:

• Separation of production and non-production environments

• Segregation of duties

• Technical peer reviews

• Notifications

• Testing and validation

• Rollback / backout procedures

• Documentation of complete process

• Emergency change procedures
   

Operations requiring the change management process include, but are not limited to:

• Infrastructure and software deployments

• Infrastructure and software upgrades and patches

• Infrastructure, software, and environment decommissions

• System configuration changes

• Certificate deployments and updates

• Queries that will or may alter data

• System and application restarts

• Environment refreshes

Proposed changes to Mitratech Platform components flow through a process that includes authorization, testing and approval prior to production deployment. This process and its operations are audited in Mitratech’s annual SOC 2 Type II report.

Patch Management

Mitratech applies regularly scheduled operating system and platform related updates. When security vulnerabilities are published, Mitratech promptly applies package updates to maintain the security of the environment. Risk scores are applied to vulnerabilities and are prioritized based on impact and severity.

Industry standard patching protocols are used, including applying patches to non-production environments, for testing prior to being deployed to production.

Backups

Mitratech has a backup standard that applies to systems which are managed and maintained by Mitratech and Mitratech’s managed hosting providers. The policy is reviewed and updated by Mitratech Cyber Risk, Governance and Compliance on a regular basis. The Mitratech backup policy addresses control processes including, but not limited to:

• Backup scheduling and monitoring

• Retention period

• Restoration

• Encryption

• Data destruction

Mitratech client data is backed up regularly and stored in an encrypted format with the third party managed hosting providers. Logging is enabled to track backup status.

Destruction of physical documents containing sensitive data is accomplished using a third-party service. Destruction of electronic documents containing sensitive data is accomplished through the third-party hosting providers who follow documented destruction policies. This data is removed using industry standard data removal processes.

Business Continuity & Disaster Recovery (BC/DR)

Mitratech has partnered with industry leading cloud infrastructure providers to host client environments and facilitate increased uptime and availability. Mitratech as well as the managed cloud infrastructure providers are audited for SOC 2 Type II compliance, including the implementation of proper Business Continuity and Disaster Recovery (BC/DR) processes and controls.

Mitratech's BC/DR strategy includes a Business Impact Analysis (BIA), supported by an annual plan validation exercise. The BIA includes taking inventory of systems critical to business operations, measuring potential (or realized) operational impact of critical system disruption, and staffing models to support critical Mitratech systems and business operations. In the event of an unexpected outage or disruption at any office locations, employees can securely work remotely and continue facilitation of business operations and client service functions. This process has been successfully tested during the calendar year and will continue to be tested on an annual basis.

The Mitratech Disaster Recovery solution provides clients with a Recovery Point Objective (RPO) of 24 hours and a Recovery Time Objective (RTO) of five days.

Note: Mitratech also offers an optional fee-based disaster recovery service for TeamConnect which provides a near-zero-hour RPO and a 24-hour RTO.

Security Incident Response

Mitratech has system, network and security engineers continuously monitoring the Cloud Services environments. Support representatives follow a defined escalation procedure for affected sites when any incident arises.

In the event of a breach or security incident that relates to the Mitratech Platforms, the Mitratech Security team follows our Incident Response Plan. This is tested at least annually.

Risk Management

The concept of risk management is embedded within Mitratech Business and Cloud Services operations. Mitratech has established processes to identify and track potential or actual risk related to Mitratech’s business. The Management Team meets on a regular basis, has executive sponsorship, and is composed of members from across the organization.

The Mitratech Security Operations team monitors the environment for potential technical and procedural risks and brings any items identified to the Management Team for discussion. The Mitratech Security Operations team regularly evaluates risk impact and, if necessary, determines whether remediation efforts are required.

Compliance Reporting

Third Party Management

The Mitratech Cloud Services, Security Operations and Governance, Risk, and Compliance Teams are involved with vendor evaluation, selection and onboarding processes prior to vendors, sub-contractors, or other third parties being approved. Critical vendors are re-evaluated annually. 

Notice

This document is provided for informational purposes only. It represents Mitratech's current product offerings and practices as of the date of issue of this document, which are subject to change without notice. This document does not create any warranties, representations, contractual commitments, conditions or assurances from Mitratech, its suppliers, or its licensors. The responsibilities and liabilities of Mitratech to its clients are controlled by Mitratech agreements, and this document is not part of, nor does it modify, any agreement between Mitratech and its clients.

FAQs

1. Can TeamConnect send application, access logs to my organization via flat file integration or API?  Can these logs be sent to our security tools?
   Log data collected and managed by the Mitratech Cloud Services organization is for the sole use of Mitratech and is not shared with individual clients.

2. Can we “bring our own key”?
   No - At this time transparent data encryption is protected by platform managed keys.

3. Does the application store connection strings and sensitive configs in a keyvault or a secure OS password vault or an HSM?
   No

4. How are updates to the application performed?
   Updates and maintenance are applied to the application by the Mitratech Cloud Services Team upon request.  Requests for maintenance can be submitted for review and execution by the Mitratech Support and Mitratech Services teams.

5. Does your system, including integrations, databases, user screens, setup processes, documents, files, batch jobs, emails, reports, archived or retained decommission content, etc., contain ACH DFI bank account numbers?
   Collaborati has a Bank Account # field that law firm vendors can fill in but is not required. This data is protected during transit from Collaborati to TeamConnect through a secure connection. The data is masked at rest; it is not in plain text.  Regarding databases and  documents, the data on the record is not in plain text. The data is further restricted to certain maintenance IT technicians via access controls.

6. Do you provide for the encryption of this data at rest?
   TeamConnect data resides on managed Cloud infrastructure which utilizes at rest encryption for all data residing within the Cloud Services environment.  Refer to the General Settings / Encryption section of this document for more information.

7. How many ACH transactions do you initiate on an annual basis? 
   None. Mitratech does not utilize ACH transactions regarding payments as it pertains to TeamConnect. Mitratech would be privy to invoice data only, not including bank or account numbers, because that data is encrypted.

8. What steps is Mitratech taking to comply with the NACHA mandate?
   TeamConnect does not directly process invoice payments nor utilize ACH in any manner.
   TeamConnect does process vendor invoices for the purpose of review/approval, and then optionally passes them to an accounts payable system for payment.  Within that activity, Collaborati and TeamConnect includes limited sensitive information, all of which is encrypted at rest with transparent data encryption, as well as in transit, including:

• Vendor Tax ID Number - this field is required for the systems to identify vendors.

• Bank Account Number - this field is optional; it is up to the client and vendor to decide if they will pass bank information via TeamConnect.  Most clients choose not to store bank information within TeamConnect.

• Payment Details - these are optional fields whereby the AP system can pass back payment information so that TeamConnect users may reference them.  This typically includes a payment date, payment amount, and check number; however, this is configurable client by client.