Last updated March 6, 2024
This document summarizes the security controls used to protect Paidnice software, systems and customer data.
Access Controls
Staff user logins
- controlled with Google Account
- Require strong passwords enforced by Google
- Use and require 2-factor authentication
- Full audit logging via Google Workspace
- All staff required to use password management with strong unique passwords
Paidnice application servers
- Hosted with Salesforce Heroku Cloud platform
- Login to Heroku requires 2-factor authentication
- Full access logs
- Activity logs
- Secure multi-tenant cloud platform
- Access restricted to engineering team and senior management
External Systems
Microsoft GitHub
- Control access to application source code
- Require 2-factor auth
- All changes logs and reviewed
- Software deployments managed via Github Actions and require engineer approval
Marketing, Billing and Customer Service tools
- Intercom for customer support - secured with Google Account login
- Mixpanel for product analytics
- Stripe billing data - all credit card and customer billing information is stored with Stripe.
- Paidnice does not handle credit card data directly.
- Access is restricted to senior staff and requires 2-factor authentication.
Software controls
Application access
- All user logins managed with Okta’s auth0.com (https://auth0.com)
- All 3rd party tokens stored encrypted via AES 256
- All data encrypted in transit via SSL
- Data stored in Heroku Postgres database
- Continuous Protection used to automatically and continuously backup all application data.
- Data encrypted at rest via AES-256, block-level storage
- Application access logged to Google Cloud
