This policy outlines: 1) Aptible's security practices and resources, and 2) your security obligations.
Obligations under this policy (both ours and yours) are are incorporated by reference into the [Aptible Terms of Service].
Without limiting any provision of the Aptible Terms of Service, we will implement reasonable and appropriate measures designed to help you secure Your Content against accidental or unlawful loss, access or disclosure.
Our documentation may specify restrictions on how the Services may be configured, or specifications for Aptible Deploy Container Services such as apps. You agree to comply with any such restrictions or specifications.
You are responsible for properly configuring and using the Services and taking your own steps to maintain appropriate security, protection and backup of Your Content, which may include the use of encryption technology to protect Your Content from unauthorized access and routinely archiving Your Content. Aptible provides many built-in controls for you, as discussed herein. Where configurable or optional security controls (such as encryption) are offered as part of the Services, you are responsible for configuring or enabling those controls. You are ultimately responsible for determining whether the security controls applied to your Applications and data are sufficient for your requirements.
Aptible access credentials and private keys generated by the Services are for your internal use only. You may not sell, transfer or sublicense them to any other entity or person, except that you may disclose your private key to your agents and subcontractors performing work on your behalf.
Pursuant to Section 2 of the Aptible Terms of Service, you will not use the Services to create, receive, maintain, or transmit electronic HIPAA PHI or GDPR Personal Data without the corresponding agreement legal agreement (HIPAA Business Associate Agreement or GDPR Data Processing Addendum) in place between you and Aptible.
You may conduct penetration tests of your dedicated Deploy Stacks. Aptible Deploy's underlying infrastructure is covered by the "Permitted Services" listed in AWS's Penetration Testing Policy, and you are responsible for adhering to their policy.
If your testing falls under AWS's definition of Other Simulated Events, you must have this activity pre-approved by Aptible, who will submit a request for authorization with AWS.
If you discover a potential security vulnerability, please see our policy on Responsible Disclosure. We strongly prefer that you notify us in private. Publicly disclosing a security vulnerability without informing us first puts the community at risk. When you notify us of a potential problem, we will work with you to make sure we understand the scope and cause of the issue. Thank you!
Aptible runs on the Amazon Web Services global infrastructure platform.
AWS publishes an "Overview of Security Processes" whitepaper that serves as the reference material for this section. SOC 2 reports are available directly from AWS upon request.
AWS computing environments are continuously audited, with certifications from accreditation bodies across geographies and verticals, including ISO 27001, FedRAMP, DoD CSM, and PCI DSS. Additionally AWS also has assurance programs that provide templates and control mappings to help customers establish the compliance of their environments running on AWS against 20+ standards, including the HIPAA, CESG (UK), and Singapore Multi-tier Cloud Security (MTCS) standards.
AWS data centers are housed in nondescript facilities. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication a minimum of two times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff.
p. 5 - ["Amazon Web Services: Overview of Security Processes - May 2017"]
AWS data center environmental controls include:
pp. 5-8 - ["Amazon Web Services: Overview of Security Processes - May 2017"]
Please see our Reference Architecture Diagram for an explanation of the terms in this section.
Aptible Aptible Deploy stacks run in separate AWS Virtual Private Clouds. Each stack is an isolated network. Most services run in a private subnet. Only SSL/TLS endpoints and a bastion host are exposed to the Internet. Backend users connect to the stack through the bastion host, which restricts access to stack components and logs activity for review.
All public-facing EC2 instances use inbound Security Group rules configured in deny-all mode. Ports are opened as necessary for: administrative SSH access, Aptible Deploy SSH Portal Access, and Redis. Public-facing Aptible Deploy Endpoints (which consist in part of an AWS load balancer) are configured to allow traffic on all ports, but only listen on the specific ports required for functionality (e.g., 80 and 443 for an HTTPS Endpoint).
Aptible Deploy's VPC-based approach means that most stack components are not accessible from the Internet, and cannot be targeted directly by a DDoS attack.
Aptible Deploy SSL/TLS endpoints include an AWS Elastic Load Balancer, which only supports valid TCP requests, meaning DDoS attacks such as UDP and SYN floods will not reach your app layer.
Should you need to add capacity to deal with a potential attack, you can instantly scale your stack using the Aptible dashboard or command line tool.
AWS monitors and stops unauthorized port scanning. Because most of an Aptible Deploy stack is private, and all hosts run strict firewalls, port scanning is generally ineffective.
The AWS network prohibits a host from sending traffic with a source IP or MAC address other than its own. The AWS hypervisor will also not deliver any traffic to a host the traffic is not addressed to, meaning even an instance running in promiscuous mode will not receive or be able to "sniff" traffic intended for other hosts.
p. 13 - ["Amazon Web Services: Overview of Security Processes - May 2017"]
Aptible scans both the Internet-facing network and private network of a master reference stack each month. Aptible is responsible for network and host security, and remediates adverse findings without customer intervention, however you may request a scan of your dedicated VPC and its hosts as needed for your own security assessments and audits. The scope of this scan is limited to the underlying Deploy architecture, and does not include your apps, databases, or endpoints.
For app services that have an SSL/TLS endpoint attached, Aptible Deploy performs a health check on the container set before promoting it to the current release. If the health check fails, the container set is not promoted. Either way, the deploy is zero-downtime.
For any deploy, you can roll back to a previous codebase by pushing a different ref to your app's Git endpoint.
Dedicated Aptible Deploy environments are deployed on AWS VPC-based dedicated stacks, isolated at the customer level. The VPC, network, underlying instances, and AWS virtual infrastructure for your dedicated stack are not shared with any other tenant.
Aptible logs AWS and Aptible API activity, and host activity within your stack. Aptible Deploy monitors performance indicators such as disk, memory, compute, and logging issues, and automatically resolves them on your behalf.
Aptible Deploy [Managed Host-based Intrusion Detection (HIDS)] is installed on each host that runs your containers by default and will detect potential intrusions and other anomalous activities.
The Aptible Security Team monitors and investigates each event to determine the legitimacy of all activity. Crucially, the Aptible Security Team immediately responds to and resolves any issues that are discovered through investigation of anomalous activity and will notify you of any remediation steps taken.
You can optionally subscribe to the Aptible Deploy HIDS Compliance Report to provide your customers and auditors evidence that you are using HIDS to monitor, analyze, and remediate security events.
Aptible Deploy host operating systems are hardened based on the Center for Internet Security's Security Configuration Benchmark for the OS and version in use. For all operating systems:
SSH public key authentication is used to limit access to your authorized backend users during git-based deploys. Following a successful push to an Aptible git endpoint, code is copied down to your stack's build layer. The resulting images are pushed to a private stack registry, backed by AWS S3, which provides redundant, access-controlled storage.
Databases run in the database layer of your stack, on a private subnet accessible only from app or bastion layer. SSL/TLS is required if the database protocol supports it. Disk volumes backing databases are encrypted at the filesystem level using Aptible-managed AES encryption. Aptible manages the creation, access security, and destruction of encryption keys. You can check whether your database uses AES-192 or AES-256 in the Aptible Deploy dashboard. You can rekey the database by dumping/restoring it at any time. You may implement additional controls, such as database security policies or row-/column-level encryption with keys you manage.
Aptible conducts penetration testing of the Aptible Deploy infrastructure at least annually. These tests consist of open-ended, best-effort security assessments performed by qualified third-party testing firms that specialize in cloud and containerized infrastructures. The testers review the Aptible Deploy architecture, are given full read access to Aptible Deploy source code (and access to the Aptible Deploy engineering team to answer questions throughout the test), and are given privileged internal (i.e., backdoor) access to a sandbox Aptible Deploy environment. From this context, the testers attempt to identify vulnerabilities in Aptible Deploy’s control plane, core API, authentication API, and related Aptible Deploy services.
You may conduct testing of your dedicated Aptible Deploy Stacks and containerized applications as described above (“Penetration Testing Authorization”).
All vulnerabilities are classified by severity according to the level of risk they present to the confidentiality, integrity, and availability of Aptible services and customer data. Vulnerabilities are remediated on a timeline commensurate with the severity:
Aptible automatically backs up several different types of data:
AWS data centers are clustered into regions, and sub-clustered into availability zones, each of which is designed as an independent failure zone, meaning they are:
For dedicated environments, Aptible Deploy automatically distributes app containers across availability zones when a service is scaled to more than one container.
Aptible Deploy allows you to set up high-availability clustering for databases that support it.
App services on v2 stacks are automatically distributed across AWS availability zones as soon as they are scaled to more than one container.
Aptible monitors the stability and availability of customer infrastructure and automatically recovers from disruptions, including app and database failures. In the event of a disaster, Aptible restores apps from the last healthy build image and restores data from the last backup. In the event of a database outage, Aptible Deploy will automatically recover the underlying database instance and disk. If the disk is unavailable, Aptible Deploy will restore from a backup. Raw database snapshots and restored database clones are available upon request for testing and recovery.
We do not access or use Your Content for any purpose other than for developing and operating the Services and as required by law. As a routine matter, Aptible workforce members do not require access to data processed by your Aptible Deploy Containerized Services, such as data stored in your databases. Aptible workforce members are granted least-privilege access to customer environments only when a specific business need arises. Workforce members undergo criminal background screening before hire. In some cases, such as Aptible Deploy databases, you may encrypt Your Content using keys you manage.
Aptible manages information security consistent with SOC 2, HITRUST, and applicable legal and regulatory requirements such as HIPAA and GDPR.
We also run a responsible disclosure program for security vulnerabilities, with cash bounties.