Casa Compliance Center

Casa is committed to ensuring the confidentiality, integrity, and availability of your data. Here is how we protect information and comply with industry best practices.

View Monitors

Resources

Subprocessors List

Request

Privacy Policy

Visit

Terms of Service

Visit

SOC2 Type 2 Report

Request

Monitoring

Continuously monitored by Secureframe

Change Management

• Segregation of Environments
• Change Management Policy
• Secure Development Policy

Availability

• High Availability Configuration
• Testing the Business Continuity and Disaster Recovery Plan
• Automated Backup Process

Organizational Management

• Acceptable Use Policy
• Disciplinary Action
• Internal Control Policy

Confidentiality

• Retention of Customer Data
• Access to Customer Data is Restricted
• Disposal of Customer Data

Vulnerability Management

• Vulnerability and Patch Management Policy
• Third-Party Penetration Test

Incident Response

• Tracking a Security Incident
• Incident Response Plan Testing
• Incident Response Plan

Risk Assessment

• Risk Assessment
• Vendor Risk Management Policy
• Risk Assessment and Treatment Policy

Network Security

• Endpoint Security
• Logging and Monitoring for Threats
• Automated Alerting for Security Events

Access Security

• Removal of Access
• Encryption-in-Transit
• User Access Reviews

Physical Security

• Physical Security Policy

Monitoring

Change Management

Segregation of Environments

• Development, staging, and production environments are segregated.

Change Management Policy

• A Change Management Policy governs the documenting, tracking, testing, and approving of system, network, security, and infrastructure changes.

Secure Development Policy

• A Secure Development Policy defines the requirements for secure software and system development and maintenance.

Configuration and Asset Management Policy

• A Configuration and Asset Management Policy governs configurations for new sensitive systems.

Baseline Configurations

• Baseline configurations and codebases for production infrastructure, systems, and applications are securely managed.

Production Data Use is Restricted

• Production data is not used in the development and testing environments unless required for debugging customer issues.

Availability

High Availability Configuration

• The system is configured for high availability to support continuous availability, when applicable.

Testing the Business Continuity and Disaster Recovery Plan

• The Business Continuity and Disaster Recovery Plan is periodically tested via tabletop exercises or equivalents. When necessary, Management makes changes based on the test results.

Automated Backup Process

• Full backups are performed and retained in accordance with the Business Continuity and Disaster Recovery Policy.

Organizational Management

Acceptable Use Policy

• An Acceptable Use Policy defines standards for appropriate and secure use of company hardware and electronic systems.

Disciplinary Action

• Personnel who violate information security policies are subject to disciplinary action and such action is documented in one or more policies.

Internal Control Policy

• An Internal Control Policy identifies how a system of controls should be maintained to safeguard assets.

Information Security Policy

• An Information Security Policy establishes security requirements.

Information Security Program Review

• Management is responsible for the design, implementation, and management of the security policies and procedures.

Organizational Chart

• Management maintains a formal organizational chart to clearly identify positions of authority.

Performance Reviews

• Internal personnel are evaluated via formal performance reviews at least annually.

Background Checks

• Background checks or their equivalent are performed before or promptly after a new hire's start date.

New Hire Screening

• Hiring managers screen new hires or internal transfers to assess their qualifications.

Advisor Meetings on Security

• Senior management meets at least annually to review business goals and risk management activities.

Cybersecurity Insurance

• Cybersecurity insurance has been procured to help minimize the financial impact of loss events.

Independent Advisor

• The board includes senior management and external advisors who are independent from the company's operations.

Roles and Responsibilities

• Information security roles and responsibilities are outlined for personnel responsible for security, availability, and confidentiality.

Performance Review Policy

• A Performance Review Policy provides context and transparency into performance processes.

Personnel Acknowledge Security Policies

• Internal personnel review and accept applicable information security policies annually.

Code of Conduct

• A Code of Conduct outlines ethical expectations and ramifications of noncompliance.

Confidentiality

Retention of Customer Data

• Procedures are in place to retain customer data based on requirements or policies.

Access to Customer Data is Restricted

• Access to, erasure of, or destruction of customer data is restricted to personnel that need access.

Disposal of Customer Data

• Upon customer request, Company requires that data no longer needed is removed in accordance with requirements.

Data Retention and Disposal Policy

• A Data Retention and Disposal Policy specifies how customer data is to be retained and disposed of based on compliance requirements.

Data Classification Policy

• A Data Classification Policy details the security and handling protocols for sensitive data.

Vulnerability Management

Vulnerability and Patch Management Policy

• A Vulnerability Management Policy outlines processes to efficiently respond to identified vulnerabilities.

Third-Party Penetration Test

• A 3rd party is engaged to conduct a penetration test of the production environment at least annually.

Incident Response

Tracking a Security Incident

• Identified incidents are documented, tracked, and analyzed.

Incident Response Plan Testing

• The Incident Response Plan is periodically tested via tabletop exercises.

Incident Response Plan

• An Incident Response Plan outlines the process of identifying and tracking confirmed incidents.

Lessons Learned

• After any incident has been resolved, management provides a "Lessons Learned" document to the team.

Risk Assessment

Risk Assessment

• Formal risk assessments are performed, identifying threats related to security, availability, and confidentiality.

Vendor Risk Management Policy

• A Vendor Risk Management Policy defines a framework for vendor relationship management.

Risk Assessment and Treatment Policy

• A Risk Assessment and Treatment Policy governs the process for conducting risk assessments.

Risk Register

• A risk register is maintained to record the risk mitigation strategies for identified risks.

Network Security

Endpoint Security

• Company endpoints are managed with a strong password policy, anti-virus, and hard drive encryption.

Logging and Monitoring for Threats

• Logging and monitoring software is used to collect data from infrastructure to detect security threats.

Automated Alerting for Security Events

• Alerting software is used to notify teams of potential security events.

Restricted Port Configurations

• Configurations ensure networking ports, protocols, services, and environments are restricted as necessary.

Network Security Policy

• A Network Security Policy identifies requirements for protecting information and systems.

Network Traffic Monitoring

• Security tools are implemented for monitoring network traffic to the production environment.

Access Security

Removal of Access

• Upon termination or when personnel no longer require access, system access is removed.

Encryption-in-Transit

• Service data transmitted over the internet is encrypted-in-transit.

User Access Reviews

• System owners conduct scheduled user access reviews of production servers and applications.

Administrative Access is Restricted

• Administrative access is restricted based on the principle of least privilege.

Encryption and Key Management Policy

• An Encryption and Key Management Policy supports secure encryption of app secrets.

Access Control and Termination Policy

• An Access Control and Termination Policy governs access to applicable systems.

Access to Product is Restricted

• Non-console access is restricted to users with a unique SSH key.

Asset Inventory

• A list of system assets and respective owners is maintained and reviewed at least annually.

Encryption-at-Rest

• Service data is encrypted-at-rest.

Unique Access IDs

• Personnel are assigned unique IDs to access sensitive systems.

Least Privilege in Use

• Users are provisioned access to systems based on the principle of least privilege.

Complex Passwords

• Personnel are required to use strong, complex passwords and a second form of authentication.

Physical Security

Physical Security Policy

• A Physical Security Policy that details physical security requirements for the company facilities is in place.

Communications

Terms of Service

• Terms of Service are published to external users.

Privacy Policy

• A Privacy Policy details the company's privacy commitments.

Communication of Security Commitments

• Security commitments are communicated to both internal personnel and external users.

Communication of Critical Information

• Critical information is communicated to external parties, as applicable.

Description of Services

• Descriptions of the company's services and systems are available to both internal personnel and external users.

Confidential Reporting Channel

• A confidential reporting channel is made available for reporting security concerns.