Security
Senior Management is accountable for security and ensure that security capabilities and competence exist in all levels of our business. We follow a collaborative approach to guarantee the confidentiality, availability, and integrity of your data.
Application Security
API Security
The Gitana API consists of an HTTPS endpoint that uses OAuth 2.0 for authentication and SSL for channel encryption. Your company's data is always transmitted with encryption and strict authority checks with every call ensure that only principals with the correct access rights are able to retrieve, store or act upon data within Gitana.
Authentication
Authentication is done using OAuth 2.0 over HTTPS. Authorization is role-based with policy documents to describe rights of users of assets classes. Policies are assigned to individuals, groups or teams to grant or revoke access rights to individual objects, classes of objects (types), folders, projects, data stores or even entire platforms at once. Authority assignments may be direct, indirect (inherited via user/group containment) or propagated (inherited from folder containment).
Versioning
Gitana stands apart from just about every other content management product on the market in that it offers a Git-like changeset versioning model that captures all changes made by your editors or via the API. Nothing is ever lost. Every data operation is fully transactional -- every transaction payload is fully captured into its own changesets. Transactions span multiple documents and full "units of work" are written into the changeset history with every operation.
As a result, your business retains a very important capability of being able to roll back or restore to any moment in time. Gitana captures and retains your information allowing you to backtrack or restore to a prior state of your data should it be required.
Password Policy
Gitana enforces the following password policy:
- must have a min of 8 chars
- include at least one numeric character
- include at least one alphabetic character
Single Sign On (SSO)
Gitana works out-of-the-box with two popular Enterprise SSO standards -- SAML 2.0 and JWT. These standards make it easy to connect Gitana with many commercial and open-source identity providers (IDP).
On-premise customers also have the option to plug in additional SSO customizations that may allow for tighter and more specific adaptation to a corporate security policy.
Multi-Factor Authentication (MFA)
Gitana provides MFA (Multi-Factor Authentication) to make enhanced security available for your users.
When MFA is enabled, the login process to Gitana requires that verification be provided by users via a second factor. This factor may be a mobile phone, an email or an app running on a user's external device.
Environments
In Gitana, a Project is an isolated workspace in which your team can collaborate on the production and publication of content. Within each Project, you can:
- Manage the lifecycle of content and move it through workflow for approval
- Work on Release Branches and leverage Scheduled Publishing to automatically move content through QA, Staging and Production
- Publish content with integrated Deployment to Amazon S3, FTP and remote Gitana servers running anywhere in the world
Data hosting and storage
Gitana services and data are hosted in Amazon Web Services (AWS) facilities located in Virginia (US) or Frankfurt (EU). Learn more about AWS security.
The data centers used for storing your content and allowing it to be delivered to your users are certified for compliance with the ISO 27001 standard. For further information see: https://aws.amazon.com/compliance/iso-certified/.
Data storage and encryption at rest
Your data is encrypted at rest in AWS S3 buckets, AWS DB instances and block devices used by AWS EC2 instances. Amazon KMS is used for safe and secure management of public and private keys used to write and read from storage.
AES256 is used for hybrid block encrypting when required and a digital hash is computed and written to the end of each file. The verification of which on read helps to ensure that assets were not manipulated between write and read.
This ensures the content is preserved and safe from prying eyes and manipulation.
Encryption in transit
Any exchange between the User's web browser and the server uses HTTPS TLSv1.2 or TLSv1.1.
Backups
All data stored within Gitana is backed up continuously.
EBS volumes are backed up via Amazon EC2 snapshots with redundant storage across multiple data centers world-wide. In addition to the EBS volumes themselves being encrypted at rest, the snapshots are also encrypted (double encryption) using unique keys and ciphers.
Binary data is stream encrypted on write when storing into Amazon S3 buckets. These buckets are replicated in real-time (on write) so that your data are safely stored across data centers world-wide The S3 buckets are also encrypted at rest (double encryption) using unique keys and ciphers.
Customers can meet their additional backup requirements beyond what Gitana provides by using Project Export functionality.
Policies, Availability, Operational
Security policies
Gitana shares with its employees a set of security policies and guidelines, covering a range of topics, among which : strong password policy, physical security policies, best practices in cybersecurity, privacy and confidentiality rules and policy.
Security in SDLC (software development lifecycle)
Security is enforced throughout the whole release cycle. Quality assurance processes for each release involve code peer-reviews and verifying a list of security checks and/or tests to be successfully passed. Extensive non-regression testing is done and subject to approval before releasing into production.
Third-party suppliers
Gitana maintains a list of its services and software suppliers. Gitana performs a risk-analysis on third-party suppliers, reviews their security, and ensures they follow mandatory compliance laws and certifications (such as PCI compliance for payment providers, SOC2, ISO 27001 for business-critical services).
Business Continuity
Gitana addresses high availability, failure resilience and business continuity through a range of principles and processes to minimize operational disruption of services.
Gitana utilizes database replication architectures to ensure redundancy and uptime. Encrypted backups are made frequently and stored both onsite at the data center and copied to a remote storage location. Each key service layer has redundant components, such as multiple servers that provide the same service and content, to ensure any failures do not impact the rest of the system. Data centers are also equipped with controls to enforce physical security and protection against environmental hazards
Gitana implements and yearly tests runs for Disaster Recovery procedures to rapidly recover and restore both its infrastructure and content.
Uptime and SLAs
General availability status of the API and UI is available here using a third-party monitoring service.
Internal auditing
Gitana's security team is responsible for ensuring that controls are designed and are operating effectively. This consists of auditing our processes to ensure they operate according to management's intentions.
Security training
Gitana employees complete a Security and Awareness training on an annual basis.
PCI obligations
All payment instrument processing is outsourced to Braintree. Braintree is certified as a PCI Service Provider Level 1. More info: https://www.braintreepayments.com/features/data-security
Audit Logging
Gitana has tooling and processes in place for monitoring account activity related to actions across the infrastructure.
Vulnerability scanning
Gitana continuously performs vulnerability scanning using industry standards and tools.
Penetration tests
Penetration tests are performed on a yearly basis. A remediation plan is scheduled according to the criticality of the issues found, including additional tests for the resolved vulnerabilities.
System monitoring
System availability, performance and capacity are monitored to ensure that potential issues are detected, reported, logged, and resolved in a timely manner.
GDPR
Gitana fulfils its obligations and maintains transparency about how it processes personal data.
Data Processing Addendum (DPA)
Gitana is in the process of making the DPA available online, in the meantime, you can sign a DPA with us by reaching out to legal@gitana.io.
Data portability
Gitana customers can export all content in their Gitana tenant.
Personal data processed by Gitana is limited to the name and email of business users that have access to a Gitana repository.
Permanent data deletion
All customer content is permanently deleted when an account is deleted.
Incident Response Plan
We manage security incidents via a documented process, which includes notification of and cooperation with customers, data protection authorities, and law enforcement. Gitana will notify affected customers without undue delay following incident detection, where we share a preliminary assessment of the incident and are open to cooperation. We follow article 33 of the GDPR when personal data is involved, and alert the supervisory authority regarding breach of personal data.