Licenseware security

Licenseware is hosted on Google Cloud Platform and Microsoft Azure, behind Cloudflare. There are three separate production regions: Europe, the United States and Australia. Each region is its own environment, with its own data stores.

LICENSEWARE holds a SOC 2 Type 2 attestation. SOC 2 is an independent auditing standard from the AICPA, and a Type 2 report attests that the controls are designed well and work over an observation period. To get the SOC 2 Type 2 report, ask your account representative.

Licenseware runs on Google Cloud and Microsoft Azure. The diagram shows the Google Cloud deployment: traffic reaches the application and the backend server through Cloudflare and a GCP load balancer.

Both hosting providers undergo independent third-party audits. These are the providers’ own accreditations, from Google Cloud compliance and Azure compliance.

All traffic passes through Cloudflare. That includes DDoS protection, a web application firewall and bot management. A GCP load balancer fronts all public-facing endpoints.

Connections use TLS 1.2 or higher. Traffic between our services is encrypted as well.

Data and monitoring are encrypted at rest with Google-managed keys that rotate automatically. Backups are encrypted the same way.

Credentials you give us for an integration, such as an API key, an OAuth token or a password, are encrypted in the application and kept separate for each customer. OAuth tokens refresh on their own.

Sensitive fields have an extra layer of encryption in the application. Secrets are held in a managed secrets vault. They are not stored in source code.

We comply with applicable data protection regulations, including the General Data Protection Regulation (GDPR).

Every request is checked for a valid session and for the customer it belongs to. Every data query is limited to that customer. Uploaded files are stored separately per customer.

A project is shared with someone else only when a person on the project invites them.

Sign in with email and password, after you verify the email, or with Microsoft or Google. Multi-factor authentication is supported. Every request is authenticated before it reaches the application. A revoked account is blocked.

Multi-factor authentication asks for a code from an authenticator app in addition to your password.

Install an authenticator app such as Microsoft Authenticator, Google Authenticator or Authy on your phone.

Open the profile menu at the bottom left of the sidebar, then Settings, and open the Account tab. Under Security Settings, where it says “Enter your password to access security settings.”, enter your password in Password and click Unlock Security Settings.

In the 2FA area, the Authenticator app QR code is shown.

In the authenticator app, choose Add account and scan the QR code. If you cannot scan it, enter the secret key shown on the screen.

Enter the 6-digit code in Verify code and select Enable 2FA. The code refreshes every 30 seconds. After that, sign-in asks for the code as well as the password.

If you lose the device, contact support to reset MFA.

On the sign-in page, select Sign in with Google or Sign in with Microsoft.

You are sent to that provider. Enter your work email and finish their sign-in, including MFA if they require it. You then come back to Licenseware, signed in.

Access through your own provider follows that provider’s password, MFA and access rules. If sign-in fails, check that your email is allowed, that an administrator has granted access, and that the provider password is correct. For access issues, contact your own IT administrator.

NEO and the other AI features run on Google Vertex AI.

Every AI request passes through a safety layer. It filters requests that are out of scope, and it screens what you send and what comes back for prompt injection, personal data and malicious links. The safety layer is on for every AI request.

How data is used with AI is on AI use and data protection.

Code changes go through a reviewed pull request on a protected main branch.

Software is scanned for vulnerabilities before it is deployed and while it is running. Security patches for dependencies are applied automatically.

We conduct regular Vulnerability Assessment and Penetration Testing (VAPT) using industry-standard methodologies, following the guidelines of the Open Web Application Security Project (OWASP). Testing focuses on the OWASP Top Ten, such as injection and cross-site scripting.

Releases are signed, so only a verified build runs.

The platform is monitored continuously, including runtime security monitoring and alerting.

We maintain a formal incident response framework, with defined escalation procedures, communication protocols and remediation steps.

Backups run at least hourly. In a worst case, at most one hour of data could be lost.

Backups are encrypted and kept for recovery, with a longer-term archive.

The platform can be rebuilt from code, and databases can be restored to a point in time.