Information Security
Here are the tools and policies we’ve deployed to ensure our users’ data remains secure. Password management, infrastructure, certifications, and more.
Single Sign-On and Password Management
Primer uses Google Cloud Identity for Single Sign-On and 1Password for password management.
Employees are required to use a password manager for all internal and third-party user accounts and are encouraged to use strong, frequently changed, random, non-shared passwords.
Passwords to Primer user accounts are salted and hashed using industry-standard encryption algorithms before storage.
A fleet management system is used to maintain a real-time inventory and manage all company laptops, allowing our team to enforce: Software updates and patches * Full hard disk encryption * Local firewall enablement * Password strength and re-use policies * Screen lock / idle timeout guidelines * Prevention of app installation from untrusted sources.
By default we enforce the following policies on all employees and contractors:
Hard disk encryption (FileVault) enabled
OS updates required to be installed
Automatic software updates required
Screensaver must start after 15 minutes
Device password required
Infrastructure
Primer's services are hosted on AWS (Amazon Web Services), which employs strong physical security practices at its data centers (details of which can be found in this whitepaper). As described in the whitepaper, this includes, but is not limited to:
Nondescript, unmarked facilities
Strict physical access controls, including security staff, video surveillance, intrusion detection, and two-factor authentication
Logging and regular auditing of all employee access
Fire detection and suppression equipment
Fully redundant power supply, including the use of an Uninterruptible Power System and backup generators
Precise climate and temperature controls
Continuous monitoring and preventative maintenance of critical infrastructure
Storage device decommissioning process using techniques detailed in the NIST 800-88 guidelines
In addition to AWS’s physical security practices, Primer uses nondescript, unmarked facilities for employee workplace activity. Primer also logs and regularly audits all employee data access using an electronic access control system.
Network Access
Sensitive datastores are protected using [AWS Identity and Access Management (IAM)](https://aws.amazon.com/iam/#:~:text=AWS Identity and Access Management (IAM) enables you to manage,offered at no additional charge.)
Primer uses RDS with access limited to inside VPC, encryption enabled and automatic snapshots enabled
Primer employs CloudTrail for audit logging and uses Security Group
All network traffic to Primer services is encrypted via TLS
Access to production systems and other sensitive services is restricted to authorized employees only
Access rights are regularly audited and revoked the day an employee or contractor separates from Primer
The minimal level of access to Primer's production systems required for the performance of an employee’s duties is enabled
Information and Data Security
Primer's information security policy is reviewed with all new employees and available to all employees
Employees are made aware of any information security policy updates and other security-related process updates
To report an identified security vulnerability in our services, please email us at info@sayprimer.com
Primer's network and AWS instances are continuously monitored for malicious and unauthorized behavior
Primer's codebase is continuously and automatically scanned for critical vulnerabilities and other security issues
Version Control
Primer uses Github for version control with the following policies:
Protected branches for master and deployment branches
A PR template
Reviews for PRs that merge into production
A CI system to run tests
Certifications
Amazon Web Services maintains certifications and is audited regularly to maintain SOC 2 and ISO 27001 compliance, as well as other programs (see the full list here: https://aws.amazon.com/compliance). In addition, Primer's credit card payment provider (Stripe) has been independently certified to PCI Service Provider Level 1 compliance and Primer's use of Stripe addresses Primer's PCI compliance obligations under SAQ A. No sensitive credit card data is stored on Primer's services.
For more information on specific policies, controls and internal processes, please visit our terms of service and privacy policy.
Note: Primer is scheduling a PEN test as the next step towards our SOC 2 compliance report.
Last updated