1. Our Security Commitment
Security is foundational to CollaboPoint. We design, build, and operate the platform with security as a primary concern — not an afterthought. This document describes the security controls we have implemented to protect your data and maintain the integrity, availability, and confidentiality of the Service.
2. Infrastructure and Hosting
- Hosted on Google Cloud Platform (GCP), which holds ISO 27001, SOC 2 Type II, and PCI-DSS certifications.
- Primary data stored in Google Cloud Firestore and Cloud Storage with multi-region replication.
- All infrastructure provisioned with the principle of least privilege.
- Infrastructure-as-code managed with version control and peer review.
- 99.9% uptime SLA backed by Google Cloud's global infrastructure.
3. Encryption
- Data in transit: all connections encrypted with TLS 1.3. HSTS enforced with a minimum 1-year duration.
- Data at rest: all data encrypted using AES-256 managed by Google Cloud Key Management Service (KMS).
- Database: Firestore data encrypted at rest by Google Cloud.
- Storage: all files in Cloud Storage encrypted at rest.
- Authentication tokens: stored as secure, HttpOnly cookies; never in localStorage.
4. Authentication and Access Control
- Multi-factor authentication (MFA) available for all accounts; enforced for admin users.
- Session management: sessions expire after 7 days of inactivity; token refresh is server-validated.
- Role-based access control (RBAC): Owner, Admin, Member, and Viewer roles per workspace.
- Principle of least privilege applied to all service accounts and employee access.
- All production system access requires MFA and is logged.
- Sign in with Apple supported; Google OAuth and enterprise SAML/SCIM on the roadmap.
5. Application Security
- Secure development lifecycle: security review required for all major features.
- Dependency scanning: automated checks for known CVEs in all npm packages.
- Content Security Policy (CSP) headers configured to prevent XSS.
- SQL/NoSQL injection prevention through parameterised queries and Firestore SDK.
- Input validation and output sanitisation on all user-supplied data.
- CSRF protection via SameSite cookie attributes and origin validation.
- Rate limiting applied to authentication endpoints and API routes.
6. Security Monitoring and Incident Response
- Continuous monitoring via Google Cloud Security Command Center and custom alerting.
- Application-level anomaly detection for authentication failures and unusual access patterns.
- All security events logged with tamper-evident audit trails.
- Incident response plan with defined roles, escalation paths, and communication procedures.
- Data breach notification within 72 hours of discovery (UK GDPR Art. 33 compliant).
- Post-incident reviews conducted for all significant security events.
7. Vulnerability Management
- Regular automated vulnerability scanning of all infrastructure and dependencies.
- Annual penetration testing by an independent security firm.
- Responsible disclosure programme: security@collabopoint.com.
- Critical vulnerabilities patched within 24 hours; high severity within 7 days.
- CVE tracking and remediation monitored by our engineering security team.
8. Employee Security
- Background checks conducted for all employees with access to production systems.
- Security awareness training required on joining and annually thereafter.
- Employees access production data only on a need-to-know basis and via audited paths.
- All employee devices managed with MDM; full-disk encryption enforced.
- Employees may not access customer workspace content without explicit authorisation.
9. Backup and Disaster Recovery
- Automated daily backups of all Firestore databases with 30-day retention.
- Point-in-time recovery available for the last 7 days.
- Cloud Storage versioning enabled on all buckets.
- Disaster recovery tested quarterly; RTO target 4 hours; RPO target 1 hour.
- Backups stored in a separate GCP region from primary data.
10. Physical Security
CollaboPoint is a cloud-native company. All physical hardware is operated by Google Cloud, which maintains ISO 27001-certified data centres with 24/7 security, biometric access controls, CCTV, and environmental controls.
11. Compliance
- UK GDPR and EU GDPR compliant.
- Data Protection Act 2018 compliant.
- Hosted on GCP infrastructure which is SOC 2 Type II, ISO 27001, and PCI-DSS certified.
- We maintain a compliance roadmap with SOC 2 Type II certification for CollaboPoint planned.
12. Responsible Disclosure
If you discover a security vulnerability in CollaboPoint, please report it responsibly. Email security@collabopoint.com with full details. Do not exploit the vulnerability or disclose it publicly before we have had a reasonable opportunity to investigate and remediate. We aim to acknowledge all reports within 48 hours and resolve critical issues within 24 hours.
13. Contact
Security concerns: security@collabopoint.com. General privacy enquiries: privacy@collabopoint.com.