Security at C1
Our own practices are mission-critical to the access controls we provide for our customers.
Built by people who have done this before
Our team is composed of long-time security, identity, and infrastructure experts who've spent their careers building enterprise-grade products in highly secure environments.
We understand that our own security and privacy practices are mission-critical to our ability to provide modern privileged access and governance for our customers.
How we secure C1
Each domain is reviewed as part of our annual SOC 2 Type II audit.
Employee access
C1 employees hold only the access they need to do their work, and have no path to customer secrets.
- Internal systems use SSO and multi-factor authentication wherever the system supports it.
- Secure password vaults store credentials for the systems that do not support SSO.
- Customer API keys and secrets are not accessible from any internal tooling or dashboard.
- Background checks are performed annually for all employees.
- Security training is provided annually for all employees.
Network
There is no interactive route from a workstation or office network into a running environment.
- We use Amazon EKS managed node groups with no remote access.
- No workstation has network access to our deployed environments.
- Office Wi-Fi grants no additional permissions or authorization.
Data and infrastructure
Customer data is isolated per tenant and encrypted in layers. The services exposed to the internet cannot read it.
- Tenant isolation is enforced through decryption controls that stay within tenant boundaries.
- Traffic to C1 is encrypted with TLS 1.2 or higher; internal services and traffic use mutual TLS.
- API keys and secrets are encrypted with AWS KMS symmetric keys, then encrypted again at rest in storage.
- Objects are stored and encrypted at rest in Amazon DynamoDB.
- Internet-facing API services are unable to decrypt data.
- Explicit firewall rules govern all service communication, with narrowly scoped security groups managed in code.
Service availability
Redundancy spans zones and Regions, and recovery is rehearsed rather than assumed.
- Infrastructure spans multiple Availability Zones in every AWS Region we use.
- Data in our object store is backed up continuously and replicated across AWS Regions.
- Disaster recovery dry runs are performed annually.
High-level architecture
How requests, connectors, and encrypted storage fit together.
Security Contacts
Tell us who to reach when something affects your organization.
- You can set primary email addresses to receive security notifications for your C1 organization, so the right people hear about important account safety events promptly.
- When we detect a security issue, your assigned Security Contact is notified. This proactive approach lets you quickly mitigate potential security risks.
- To configure Security Contacts for your organization, you must have Admin permissions.
Vulnerability reporting
We deeply appreciate any effort to discover and coordinate the disclosure of security vulnerabilities. C1 does not currently operate a public bug bounty program or offer monetary rewards, but reporters may be acknowledged on a wall of champions.
We ask that you not publicly disclose the issue until we've had a chance to review and address it.
- —Steps to reproduce or a proof of concept
- —Any relevant tools, including versions used
- —Tool output
- —HTTPS configuration, including supported TLS versions and ciphersuites
- —HTTP headers for HSTS, CSP, and clickjacking or XSS protection
- —DNS records, including SPF, DKIM, DMARC, and CAA
- —Web applications that allow excessively long passwords
