Platform Security



Agiloft takes the issue of security very seriously. We work to ensure that the Agiloft application, infrastructure, and organization implement the best practices necessary to provide military-grade security to our customers. And we engage third party security specialists to actively test compliance.

Agiloft employs a multi-layered security policy, summarized below:

Development process

The code is developed in accordance with the CERT Secure Coding Standard for Java and the OWASP Enterprise Security API (ESAPI) is used within the application to implement security best practices.


3rd Party Validation

The product was tested by a security team from the U.S. Air Force and approved for deployment on the Secure Network at the U.S. Department of Defense.

Agiloft engages third party security companies to perform in-depth penetration assessments of the Agiloft application and our hosting infrastructure after all major upgrades. This assessment uses both manual and automated techniques to search for technical vulnerabilities. In addition, we engage external parties to test the organization for resilience against social engineering attacks, a critical area of security which is too often overlooked. A copy of the most recent security audit can be provided upon receipt of a signed NDA.

Skyhigh Enterprise-ReadyWe commission an independent security audit every year (changing auditors every year to ensure a fresh look) to provide an objective and comprehensive evaluation of our security controls and enterprise readiness. The audit focuses on a detailed set of criteria that fully address the most stringent security requirements for data protection, identity verification, service security, business practices, and legal protection.

We welcome additional security audits that current or potential customers may wish to perform and will provide any assistance required to conduct a rigorous evaluation.


Hosting Infrastructure

With our Hosted Service, you have the choice between two different options— a hybrid vXchnge/AWS hosting solution or an AWS-only hosting solution. Both vXchnge and AWS offer full regulatory compliance with key standards such as SSAE 18, SOC 2 Type II, HIPAA, and GDPR. For more complete security and compliance details, refer to the information listed on each provider’s website. For further information about Agiloft’s Hosted Service, see our Hosted Service datasheet.

The hosting infrastructure is firewall protected and the individual servers are hardened by the application of security best practices.


Build/QA process

The build process includes scanning for malware using both Symantec Endpoint Protection and NOD32. In addition, the build process includes virus scanning by Clam.

QA uses Burp Suite Pro to test security against exploits by malicious external users or internal power users.


Security Policy

Our security policies and procedures reinforce the security of our software and hosting infrastructure. For more information, see the Security Policy page.


Deployment

Our software provides precise access control at the record and field level, all managed by extensible group permissions. It implements security best practices such as encrypting passwords using the SHA-2 one-way hash function and protecting all communications with SSL encryption.


For a downloadable and printer-friendly version of this page, refer to our Security datasheet.