Security & Compliance
Torii's applications and services are designed with security in mind. Clear procedures and automated controls ensure your data remains protected while you stay in control.
Questions about our security measures?
Email our dedicated security team at security@toriihq.com.
Torii leverages Amazon Web Services for hosting and compute power. Amazon maintains and demonstrates SSAE-16 SOC 1, 2 and 3, ISO 27001 and FedRAMP/FISMA reports and certifications. Web servers and databases run on servers in secure data centers.
To maintain a robust disaster recovery strategy, Torii leverages Amazon Aurora automated daily backups which allows us secure backups as well as quick recovery. We test our backup recovery regularly.
All data stored in the Service is encrypted both in transit and at rest. Database instances, including read replicas and backups, are encrypted using the industry standard AES-256 encryption algorithm. Encryption is enforced via TLS to all data in transit.
Torii authenticates all users with a unique ID and password. All Torii user passwords are encrypted and salted using Bcrypt. Access to Torii restricted API resources are always authenticated.
Torii supports SAML 2.0 authentication, allowing customers to implement Single Sign-On (SSO) with their own access policies, including whitelisting and multi-factor authentication (MFA). Customers may also integrate user authentication with their own policy store (e.g., Active Directory).
All Torii employees and contractors sign confidentiality agreements upon commencing work for Torii.
Torii employees and contractors are trained upon hire and no less than annually thereafter regarding confidentiality, data security, and data handling practices.
Administrative access to our production environment is limited to a restricted number of individuals. Access to additional individuals is given only in extreme circumstances, for a specific purpose, and is limited in duration. Such access to these additional individuals is given only after the explicit approval of the security team. User access is evaluated on a quarterly basis and revoked upon termination.
Torii reviews the security and privacy practices of potential vendors to ensure their standards meet or exceed our own.
Torii has implemented business continuity and disaster recovery policies designed to secure your data even in the event of a disaster. We review our policies no less than annually.
Torii has implemented monitoring across all components in the architecture. Alerts are generated and sent to relevant stakeholders using internal communications platforms based on predefined rules. The notifications are reviewed and processed based on their level of urgency / priority.
Torii performs at least one penetration test per year, which is conducted by accredited and completely independent information security companies. Vulnerabilities, if found, are addressed as part of our Risk Management Policy.
All employees and contractor laptops are equipped with software to scan for malicious threats.
Torii undergoes annual independent SOC 2, Type II audits for security, availability, and confidentiality.
Torii is SOC 2 Type II certified, confirming that the product and services Torii provides are mature, robust, and secure, and that we are actively creating an organization that supports these goals.
It also means that our software development processes and practices meet required levels of oversight and monitoring, so that we can proactively monitor, identify and address any unusual activity, remediate it with deep contextual insight, and take corrective action, if and when it is needed.
With customers in nearly every country around the world, we adhere to the General Data Protection Regulation (GDPR) expanding the privacy rights granted to European individuals.
We proactively look at and constantly improve processes related to personal data privacy protection in compliance with legal and contractual obligations for GDPR compliance.
