Security Policy.
Hundreds of clients have entrusted Codium with their applications and data. We make it a priority to take our users' security and privacy concerns very seriously, and we're committed to being transparent about our security infrastructure and practices.
- ISO 9001 certifiedSecurity management integrated with our audited quality system.
- Australian hostingManaged AWS infrastructure in Sydney, with encryption in transit and at rest.
- Point-in-time recoveryBackups to each client's RTO and RPO, with AWS Aurora restore to any point in time.
- Monitored in real timeAutomated alerts to our team by chat, email and SMS.
Protection and reliability, measured by the trust of our clients
We strive to ensure that client applications and data are kept securely, and that we collect and retain only as much data as is required to provide our services in an efficient and effective manner.
We employ some of the most advanced technology for internet security that is commercially available. Security assurance at Codium occurs through an integrated set of processes and activities rather than individual parts of the organisation, and can occur directly through us or through our strategic partners.
Our goal is to consistently provide the highest level of protection and reliability of client applications and information. Our measure of success is our performance in security audits, the trust of our customers and, ultimately, the repeat business and referral of satisfied clients.
Codium leaders at all levels are responsible for defining metrics and improvement targets, modelling appropriate behaviours and driving actions to achieve our security goals.
All of our staff and strategic partners are expected to adhere to our security assurance practices and to contribute to their continuous improvement.
Our Security Policy and Management System is integrated and implemented through the active involvement of the entire organisation in complying with ISO 9001 standard requirements for the provision of software development and support services.
The minimum we hold every project to
Wherever possible and of meaning, Codium will ensure the below practices and outputs as minimum security assurance requirements.
01Hosting
The internet is accessible to everyone, including disreputable people with obscure motives, so whenever there is a possibility of exploiting a system it will be attempted. Choice of hosting environment is critical. We only deploy to environments with encryption in transit and at rest, so data moving between the browser, the server and storage can't be intercepted or modified. We only host on platforms that have been tested against our security, scalability, support timeliness and low vulnerability to attack criteria.
02Design
Security begins with design. The potential harm from loss, inaccuracy, alteration, unavailability, misuse and unauthorised access is identified upfront and built into the design, so the application operates at the level of security that best mitigates it. Our security design addresses access control, audit trails and usage records for physical and network access, data management, integrations and the client's IT and non-IT environment.
03General IT security practices
Beyond software-specific practices we adhere to generally accepted IT security practice across user authentication, data encryption, data portability, privacy, physical security, availability, network security, storage security, and organisational and administrative security.
04Backups
Backups are performed to each client's agreed recovery time (RTO) and recovery point (RPO) objectives. Databases run on AWS Aurora with continuous backup, so they can be restored to any point in time, minimising loss in the case of a problem or disaster.
05Managing quality
All projects include the planning and performance of the software quality management activities required to ensure the customer's stated and implied needs are met and the product is developed in compliance with recognised best practice.
06Server maintenance
We undertake server maintenance with built-in automatic alerts to keep on top of upgrades and patches and limit attacks.
07Monitoring
Automated monitoring detects application or server changes and security breaches and alerts our security team through our team communication platform, email and SMS, so we can act in real time.
08Coding practices
Our engineers follow best practice and industry-standard secure coding guidelines, developing to at least Level 1 of the OWASP Application Security Verification Standard.
Have a security questionnaire?
We're used to completing vendor security assessments for government and enterprise clients. Send it through and we'll turn it around.
Send it to usNeed the detail for your own policy?
Talk to us about hosting, data residency, access control or anything else your security team needs to sign off on.