BYOD HOSTING AND DATA SECURITY
Last Updated: April 8, 2025
Infrastructure
BYOD, Inc. leverages best-in-class third-party hosting infrastructure and services through Amazon Web Services (AWS). AWS provides:
- Global coverage delivered through multiple cloud points of presence in the US, EMEA, and APAC regions.
- Each location adheres to high global standards for availability and security, including:
- Infrastructure architecture exceeding Tier 3 accreditation standards
- Proven mission-critical hosting
- At least N+1 capacity and redundancy across compute, network, storage, power, and HVAC
- 24/7/365 security operations
Platform and Applications Architecture
The ACP outlines the access available to employees in regard to an organization’s data and information systems. Included are:
- Access control standards
- Operating system software controls
- Complexity of corporate passwords.
- Monitoring of access and use of corporate systems
- Securing unattended workstations
- Access is removal when an employee leaves the organization
Backups
- Regular backup cycles with transaction log backups, nightly incremental backups, and weekly full backups.
- Retention aligned with jurisdictional requirements; longer in non-GDPR/CCPA regions.
- On-going verification and restoration testing procedures to validate data integrity.
- Off-site backup replication to geographically remote AWS cloud locations.
- All backups are securely encrypted.
Disaster Recovery
- In-region, geographically remote secondary cloud presence enables hot-site recovery and data protection.
- Recovery objectives follow best practices for RPO and RTO.
Performance
- Continuous performance and health monitoring of all systems.
- Web and mobile platforms optimized for fast response using modern UI frameworks, small data packets, and cached data.
Management and Monitoring
- 24/7/365 platform and application monitoring using integrated tools.
- Global operations staff on standby 24/7 to respond to alerts.
Service Response
- Formal Service Level Agreements categorize incidents by severity (P1–P4).
- Pre-defined response and resolution time targets per severity level.
System Maintenance
- Planned maintenance impacting availability is communicated at least one week in advance.
- Emergency maintenance may be performed immediately; BYOD, Inc. will notify users as soon as possible.
Security
Physical Security
- AWS facilities use CCTV, external barriers, proximity cards, and secure zones.
- Servers are located in locked cages with fire, gas, flood detection, and suppression systems.
- Facilities monitored via comprehensive building management systems.
Logical Security
- Access granted based on the principle of least privilege.
- Strong password policies enforced.
- Security gateways manage all Internet access points.
- Remote access restricted to secure authenticated channels.
Information Security
- A dedicated Senior Information Security Officer oversees policies and practices.
- Executive oversight includes quarterly security reviews.
- Adheres to all applicable local laws and regulations.
Security Policies
- Documented policies are reviewed annually and communicated to all staff.
- Covers risk management, access control, change management, patch management, BCDR, subprocessor security, and incident response.
Staff
- Employees undergo annual information security training.
- All staff are bound by confidentiality agreements and policy adherence.
Laws and Regulations
- A dedicated Legal team ensures compliance with applicable laws and regulations in collaboration with the security and product teams.
Vulnerability Reporting Policy
- Keeping customer data secure is BYOD’s top priority.
- Independent security testing is appreciated when conducted responsibly, legally, and non-disruptively.
- To report a vulnerability, contact security@byod.ai with detailed findings and reproduction steps.
Compliance and Accreditation
- BYOD, Inc. uses AWS, which supports 143 compliance standards including PCI-DSS, HIPAA, FedRAMP, GDPR, and NIST 800-171.
- BYOD aligns its internal controls with frameworks such as SOC 2 Type II and ISO 27001 to support customer compliance needs.
Contact
For any security-related questions or documentation requests, please contact: