B2L’s Security

Last Updated on: Oct 26th, 2020

B2L provides Software as a Service (SaaS) products to may users worldwide to solve their business problems. Security is a key component in our offerings, and is reflected in our people, process, and products. This page covers topics like data security, operational security, and physical security to explain how we offer security to our customers.

Our security strategy involves the following components:

Organizational security
Physical security
Infrastructure security
Data security
Identity and access control

Operational security
Incident management
Responsible disclosures
Vendor management
Customer controls for security

Organizational security

We employ strict policies and procedures encompassing the security, availability, processing, integrity, and confidentiality of customer data.

Employee background checks

Each employee undergoes a process of background verification. We hire reputed external agencies to perform this check on our behalf. We do this to verify their criminal records, previous employment records if any, and educational background. Until this check is performed, the employee is not assigned tasks that may pose risks to users.

Dedicated security and privacy teams

We have dedicated security and privacy teams that implement and manage our security and privacy programs. They engineer and maintain our defense systems, develop review processes for security, and constantly monitor our networks to detect suspicious activity. They provide domain-specific consulting services and guidance to our engineering teams.

Endpoint security

All workstations issued to B2L employees run up-to-date OS version and are configured with anti-virus software. They are configured such that they comply with our standards for security, which require all workstations to be properly configured, patched, and be tracked and monitored by B2L's endpoint management solutions. These workstations are secure by default as they are configured to encrypt data at rest, have strong passwords, and get locked when they are idle. Mobile devices used for business purposes are enrolled in the mobile device management system to ensure they meet our security standards.

Physical security

At workplace

We control access to our resources (buildings, infrastructure and facilities). Human Resource (HR) team establishes and maintains the purposes specific to roles. We maintain access logs to spot and address anomalies.

At Data Centers

Access to the Data Centers is restricted to a small group of authorized personnel. Any other access is raised as a ticket and allowed only after the approval of respective managers.

Monitoring

We monitor all entry and exit movements throughout our premises in all our business centers and data centers through CCTV cameras deployed according to local regulations. Back-up footage is available up to a certain period, depending on the requirements for that location.

Infrastructure security

Network security

Our network security and monitoring techniques are designed to provide multiple layers of protection and defense. We monitor firewall access with a strict, regular schedule. Additionally, these changes are reviewed every three months to update and revise the rules. Our dedicated Network Operations Center team monitors the infrastructure and applications for any discrepancies or suspicious activities. All crucial parameters are continuously monitored using our proprietary tool and notifications are triggered in any instance of abnormal or suspicious activities in our production environment.

DDoS prevention

We use technologies from well-established and trustworthy service providers to prevent DDoS attacks on our servers. These technologies offer multiple DDoS mitigation capabilities to prevent disruptions caused by bad traffic, while allowing good traffic through. This keeps our websites, applications, and APIs highly available and performing.

Monitoring

Network redundancy

We use a distributed grid architecture to shield our system and services from the effects of possible server failures. If there's a server failure, users can carry on as usual because their data and B2L services will still be available to them.

Data security

Secure by design

Every change and new feature is governed by a change management policy to ensure all application changes are authorized before implementation into production.

Data isolation

Our framework distributes and maintains the cloud space for our customers. Each customer's service data is logically separated from other customers' data using a set of secure protocols in the framework. This ensures that no customer's service data becomes accessible to another customer. The service data is stored on our servers when you use our services. Your data is owned by you, and not by B2L. We do not share this data with any third-party without your consent.

Encryption

All customer data transmitted to our servers over public networks is protected using strong encryption protocols.

Data retention and disposal

We hold the data in your account as long as you choose to use B2L Services. Once you terminate your B2L user account, your data will get deleted from the active database during the next clean-up that occurs once every 6 months. The data deleted from the active database will be deleted from backups after 3 months. In case of your unpaid account being inactive for a continuous period of 120 days, we will terminate it after giving you prior notice and option to back-up your data.

Identity and access control

Single Sign-On (SSO)

B2L offers single sign-on (SSO) that lets users access multiple services using the same sign-in page and authentication credentials. When you sign in to any B2L service, it happens only through our integrated Identity.

Multi-Factor Authentication

It provides an extra layer of security by demanding an additional verification that the user must possess. Currently, different modes like biometric Touch ID or Face ID, Push Notification, QR code, and Time-based OTP are supported.

Operational security

Logging and Monitoring

We monitor and analyze information gathered from services, internal traffic in our network, and usage of devices and terminals. We record this information in the form of event logs, audit logs, fault logs, administrator logs, and operator logs. These logs are automatically monitored and analyzed to a reasonable extent that helps us identify anomalies such as unusual activity in employees’ accounts or attempts to access customer data. We store these logs in a secure server isolated from full system access, to manage access control centrally and ensure availability.

Malware and spam protection

We scan all user files using our automated scanning system that’s designed to stop malware from being spread through B2L's ecosystem. Our custom anti-malware engine receives regular updates from external threat intelligence sources and scans files against blacklisted signatures and malicious patterns.

Backup

We run incremental backups everyday and weekly full backups of our databases. All backed up data are retained for a period of three months. If a customer requests for data recovery within the retention period, we will restore their data and provide secure access to it. The timeline for data restoration depends on the size of the data and the complexity involved.

Incident management

Reporting

We have a dedicated incident management team. We notify you of the incidents in our environment that apply to you, along with suitable actions that you may need to take. We track and close the incidents with appropriate corrective actions. Whenever applicable, we will identify, collect, acquire and audit logs regarding incidents that apply to you. Furthermore, we implement controls to prevent recurrence of similar situations.

Breach notification

As data controllers, we notify the concerned Data Protection Authority of a breach within 72 hours after we become aware of it, according to the General Data Protection Regulation (GDPR). Depending on specific requirements, we notify the customers too, when necessary. As data processors, we inform the concerned data controllers without undue delay.

Responsible Disclosures

We are committed to working with the community to verify, reproduce, respond to, legitimate, and implement appropriate solutions for the reported vulnerabilities.

Vendor management

We evaluate and qualify our vendors based on our vendor management policy. We onboard new vendors after understanding their processes for delivering us service, and performing risk assessments. We take appropriate steps to ensure our security stance is maintained by establishing agreements that require the vendors to adhere to confidentiality, availability, and integrity commitments we have made to our customers. We monitor the effective operation of the organization’s process and security measures by conducting periodic reviews of their controls.

Customer controls for security

So far, we have discussed what we do to offer security on various fronts to our customers. Here are the things that you as a customer can do to ensure security from your end:

Select a unique, strong password and protect it.
Use multi-factor authentication
Use the latest browser versions, mobile OS and updated mobile applications to ensure they are patched against vulnerabilities and to use latest security features
Exercise reasonable precautions while sharing data from our cloud environment.
Classify your information into personal or sensitive and label them accordingly.
Be aware of phishing and malware threats by looking out for unfamiliar emails, websites, and links that may exploit your sensitive information by impersonating B2L or other services you trust.

Conclusion

Security of your data is your right and a never-ending mission of B2L. We will continue to work hard to keep your data secure, like we always have.