Security Policy
This policy is effective as of 1st January 2025
1. Overview
MOOST is committed to ensuring the highest standards of data protection in compliance with the EU General Data Protection Regulation (GDPR) and other applicable regulations. This Security Policy outlines the organizational and technical measures implemented to prevent unauthorized access, use, alteration, or disclosure of customer data. The MOOST services are hosted on Amazon Web Services ("AWS"), Microsoft Azure ("Azure"), and this policy details MOOST’s security controls within its AWS and Azure instance.
2. Best Practices
2.1. Incident Response Plan
MOOST maintains a formal incident response plan that aligns with GDPR Article 33 (Notification of a Personal Data Breach). In case of a security breach impacting personal data, MOOST will:
- Promptly notify affected customers in compliance with GDPR timelines.
- Provide a description of the breach, its impact, and mitigation measures taken.
- Conduct a post-incident analysis to prevent recurrence.
2.2. Secure Development and Deployment
MOOST follows secure development practices in accordance with industry standards. We utilize automated build and deployment pipelines to ensure security patches are applied promptly, supporting rapid response to emerging threats.
3. Infrastructure Security
MOOST’s infrastructure is hosted in AWS facilities located in Frankfurt (eu-central-1), in Microsoft Azure facilities located in Frankfurt (eu-west-central) ensuring compliance with GDPR data residency requirements. Key measures include:
- All of our services and data are hosted in AWS and Azure facilities that are protected by AWS and Azure security, as described at http://aws.amazon.com/security/sharing-the-security-responsibility for AWS and at https://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure for Azure. MOOST services have been built with disaster recovery in mind.
- All of our infrastructure is spread across 3 availability zones and will continue to work should any one of those zones fail unexpectedly. Amazon does not disclose the location of its data centers. As such, MOOST builds on the physical security and environmental controls provided by AWS and Azure. See http://aws.amazon.com/security for details of AWS security infrastructure and https://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure for Azure security infrastructure.
- All of our servers are within our own virtual private cloud (VPC) with network access control lists (ACL’s) that prevent unauthorized requests getting to our internal network.
- MOOST uses a backup solution for datastores that contain customer data.
4. Data Protection
MOOST services and data are hosted in Amazon Web Services (AWS) facilities in Frankfurt (eu-central-1) and Microsoft Azure (Azure) facilities in Frankfurt (eu-west-central).
Customer data is stored in multi-tenant datastores; we do not have individual datastores for each customer. However strict privacy controls exist in our application code that are designed to ensure data privacy and to prevent one customer from accessing another customer’s data (i.e., logical separation). We have many unit and integration tests in place to ensure these privacy controls work as expected. These tests are run every time our codebase is updated and even one single test failing will prevent new code being shipped to production.
Each MOOST system used to process customer data is adequately configured and pathed using commercially-reasonable methods according to industry-recognized system-hardening standards.
4.1. Data Transfer
- All data sent to or from MOOST is encrypted in transit using 256-bit encryption.
- We also encrypt data at rest using an industry-standard AES-256 encryption algorithm.
4.1. Data Retention
Customer data is retained only for the duration necessary to fulfill contractual obligations, after which it is securely deleted in accordance with GDPR Article 17 (Right to Erasure).
5. Authentication
MOOST enforces multi-factor authentication (MFA) for all access to sensitive systems and follows a zero-trust model to ensure secure access from any location. Role-based permissions provide granular access control to MOOST's services.
- MOOST is served 100% over https. MOOST runs a zero-trust corporate network.
- There are no corporate resources or additional privileges from being on MOOST’s network.
- MOOST enables permission levels to be set for any employees with access to MOOST.
- Permissions and access can be set to include app settings, billing or user data.