Enterprise-grade security & compliance

Peer code reviews to catch security issues before deployment, supporting safe and reliable software releases.

Security is embedded throughout the development process, from design to deployment.

Quarterly scans using AWS Inspector are performed to identify and remediate security weaknesses. Regular testing with BurpSuite and ZAP. Automated monitoring via AWS Security Hub, CloudTrail, and AWS Config.

Layered protection using AWS and open-source technologies is implemented to block malicious traffic and defend against threats such as SQL injection and cross-site scripting (XSS).

Onboarding procedures include NDAs and background checks to help safeguard sensitive information.

Robust data backup and recovery mechanisms are implemented to ensure data integrity and availability.

Customers can initiate on-demand backups and restores at any time through Gridly’s application features

Automated point-in-time backups and restores are performed using AWS RDS, ensuring continuous data protection and rapid recovery capabilities.

AES-256 for encryption at rest with AWS KMS is used and cryptographic keys are assigned to specific roles based on least privilege access and keys are automatically rotated yearly. Usage of keys is monitored and logged.

Security policies, including Information Security and Access Control to guide Gridly team to manage risks and protect customer data, meeting ISO 27001 standards.

Gridly uses TLS v1.2 or higher for all data transfers, with regularly updated certificates to ensure secure connections.

Gridly limits system access to only what’s needed, using role-based controls RBAC and regular audits to prevent unauthorized access.

Public SSH access blocked. Secure VPN server connections required across all environments.

AWS Security Groups and Network ACLs applied to control network traffic and block unauthorized access.

AWS CloudTrail used to log, monitor, and retain account activity across the AWS infrastructure.

AWS Config applied for continuous monitoring, auditing, and evaluation of AWS configurations.

In-house gateway, error tracking, and logging services based on Nginx, Sentry, and Grafana Loki to monitor performance, requests, and security-related events.

Automated monitoring of external-facing networks to detect malicious traffic.

Prevention layer within the API gateway to terminate malicious requests before they reach microservices.

Security notifications routed to responsible employees for timely response.

Unique accounts assigned to every user to ensure traceability and secure access.

Malware detection software installed to support system protection.

Acceptable Use Policy enforced through employee training and formal acknowledgment, defining permitted use of systems and data.

Annual testing of business continuity and disaster recovery plans to support operational resilience.

Code of Conduct outlining employee security and ethical responsibilities.

Documented disaster recovery plan defining procedures and recovery objectives to restore services after disruptions.

Dedicated team with defined roles to respond to security incidents.

Internal procedures documented for handling production incidents.

Customers notified in the event of security issues through direct email communication.

Detailed updates shared on the online status page, including current status and progress.

Clear information provided on when patches will be applied and the expected timeframe for resolution.

Annual security awareness training for all employees. Development team receives additional regular training on OWASP Top 10 vulnerabilities to support secure coding practices.

Production databases and servers monitored using AWS and open-source tools (Grafana, Prometheus, Exporter), with alerts for suspicious activity and resource usage spikes.

All hard disks encrypted with AES-256 to protect data at rest. The production database layer (AWS RDS) encrypted with AES-256 via AWS KMS.

MFA required for all accounts to add an extra layer of security.

Inactive sessions automatically locked to help prevent unauthorized access.

Clear Terms of Service defining responsibilities and acceptable platform use to support compliance with security standards.