Encryption and Resource Access

  • End-to-end 256 bit SSL/TLS encryption
  • Encryption is enforced with HTTP Strict Transport Security 
  • A Content Security Policy is enforced
  • All non-essential ports and external network interfaces blocked by default
  • No financial data or credit information is stored in any Circus system
  • Secure encrypted single sign-on identification service is available
  • All account passwords are stored as one-way hashes and salted
  • All client-side communication, sessions, and input are validated server-side
  • All documents are securely encrypted on Amazon S3 using AES-256 and Managed Keys
  • All account data is encrypted and securely stored
  • All data is backed up
  • In the event of server failure, all critical systems have redundant failovers to prevent service disruptions
  • Two factor authentication (coming soon)

Source Code

  • We perform static code analysis of all production code
  • We have Integration and Unit tests for all critical systems
  • All sub-dependencies have been vetted for security and performance issues
  • All sub-dependencies are directly bundled into the Circus application
  • We follow strict compliance with source code licensing and open-source licensing

Key Management 

Circus maintains a strict policy for assigning and distributing keys which may access any production or development systems.

  • Master access keys are never distributed to any employees
  • Access keys are never stored in any version control system
  • Access keys are never stored anywhere as plaintext
  • Individual access keys are generated per employee with developer only access

Secure Workstations

  • All company workstations and laptops use encryption for storing of any potentially sensitive data
  • All company workstations and laptops use anti-malware and antivirus software
  • All client data is always anonymized for development purposes

Employee Awareness

  • All Circus employees have been instructed on best practice security standards
  • Circus employees are granted granular role access to resources
  • Any employee access to sensitive data is tracked and monitored
  • Developers only work with anonymized data

Data Loss / Security Breach 

In the event of a loss of data or potential security breach, you will be contacted immediately and be kept updated in real-time as Circus assesses the situation. 

Circus will quickly take any measures necessary to secure and recover your data. A full incident report will be made available by Circus should any incidents occur.

Did this answer your question?