Operational security¶
This page describes how we operate the Cloud edition. On the Enterprise edition the same concerns are yours, since the deployment is yours: see Shared responsibility.
Network & endpoint security¶
Drovio Production and test/development environments both run on AWS, in separate VPCs with no route between them. Neither environment can reach the other, and they share no instance, database or storage. Production is deployed across several AWS regions, with the main stack and customer data in Oregon (see Hosting); the test environment is a single, self-contained VPC.
- Production servers are only publicly accessible when needed, and only minimal, strictly necessary port ranges are opened.
- We log, monitor and internally audit our environments, with alerts in place to indicate any potential intrusion.
- Administrative access goes through a bastion over an encrypted tunnel: Production servers are never administered directly from the Internet. It relies on encryption keys and two-factor authentication, and applies to every server, whether or not it houses customer data.
- Drovio adheres to least-privilege practices and role-based permissions when provisioning access.
- Personnel are required to use unique, complex passwords and our approved password manager where possible.
Penetration testing¶
We perform our own internal penetration testing on a quarterly basis. We also welcome customers to run their own tests: our Enterprise edition comes with a free trial period that can be used to this end.
Security certifications¶
We don't hold any security certifications at the moment, but as the company grows we intend to remedy that.
Vulnerability handling¶
Reporting¶
If you believe you have found a vulnerability in Drovio, report it to security@drovio.com with enough detail to reproduce it. We acknowledge every report within three business days and keep you posted on the outcome. Please give us a reasonable window to fix the issue before disclosing it publicly.
For questions about personal data rather than about a vulnerability, use privacy@drovio.com; see Compliance & data processing.
Remediation targets¶
Once a vulnerability is confirmed, we score it with CVSS v3.1 and aim to publish a fix within the following windows:
| Severity | CVSS score | Target |
|---|---|---|
| Critical | 9.0 to 10.0 | 7 days |
| High | 7.0 to 8.9 | 30 days |
| Medium | 4.0 to 6.9 | 90 days |
| Low | 0.1 to 3.9 | Next scheduled release, 180 days at most |
Three things define what these targets mean in practice:
- The clock starts when the vulnerability is confirmed, not when it is reported.
- What we commit to is a fix or a documented workaround being available, in a released version. Installing it is up to you on the Enterprise edition, where we cannot update your servers for you (see Shared responsibility).
- For a vulnerability in a third-party component we ship rather than in Drovio itself, the window starts when the upstream fix becomes available.
Targets apply to the current release. Older versions are not patched: since releases stay backward compatible, upgrading is always the remediation path.