Data Security Protection Statement
We take our users’ security and privacy concerns seriously. We strive to ensure that user data is kept securely, and that we collect only as much personal data as is required to provide our services to users in an efficient and effective manner. We use some of the most advanced technology for Internet security that is commercially available today. This Security Statement is aimed at being transparent about our security infrastructure and practices, to help reassure you that your data is appropriately protected.
Data Storage Location
All data associated with our service is stored only in Canada — we are a 100% Canadian service, with all infrastructure, data storage, and staff located physically in Canada.
Application and User Security
SSL/TLS Encryption: You have the option of implementing SSL certificates on your hosted instances. cPanel provides basic SSL capabitlities, or you can purchase certificates from 3rd party providers. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) technology (the successor technology to SSL) protect communications by using both server authentication and data encryption. This ensures that user data in transit is safe, secure, and available only to intended recipients.
Two Factor Authentication: 2FA is available at the hosting account level. This is an option you can choose to enable, and is built into the core of the cPanel hosting platform. Applications you choose to host on our infrastructure may also include their own 2FA authentication options.
Data Encrypt At Rest: We offer optional 256bit-AES Data at Rest Encryption options on our all our platforms. This is supported as an add-on option and will connect to our dedicated mySQL platform, isolated from your hosting environment.
Data Encryption: Certain sensitive user data which we collect in order to do business with you, such as credit card details and account passwords, is stored in encrypted format.
Data Portability: You are free to transfer your accounts from our platform to another provider at any time. We do not have minimum contract periods.
Privacy: We have a comprehensive privacy policy that provides a very transparent view of how we handle your data, including how we use your data, who we share it with, and how long we retain it.
Physical Security
Data Center Security: Data centers are staffed and surveilled 24/7. Access is secured by security guards, visitors logs, and entry requirements such as passcards and biometric recognition.
Environmental Controls: Data centers are maintained at controlled temperatures and humidity ranges which are continuously monitored for variations. Smoke and fire detection and response systems are in place.
Location: All user data is stored on servers located in Canada. No data is stored outside Canada.
Service Availability
Connectivity: Fully redundant IP network connections with multiple independent connections to a range of Tier 1 Internet access providers.
Power: Servers have redundant internal and external power supplies. Data center has backup power supplies, and is able to draw power from the multiple substations on the grid, several diesel generators, and backup batteries.
Uptime: Continuous uptime monitoring, with immediate escalation to our support staff for any downtime.
Network Security
Uptime: Continuous uptime monitoring, with immediate escalation to our support staff for any downtime.
Testing: For services we develop or manage on your behalf, system functionality and design changes are verified in an isolated test “sandbox” environment and subject to functional and security testing prior to deployment to active production systems.
Firewall: Firewall restricts access to only required ports for the operation of our platform.
Software Patching: Latest security patches are applied to all operating system and application files to mitigate newly discovered vulnerabilities.
Access Control: Secure VPN, PKI, multifactor authentication, and role-based access is enforced for systems management by authorized engineering staff.
Virus and Exploit Scanning: All systems are protected by ClamAV anti-virus protection and real-time exploit scanning.
Logging and Auditing: Central logging systems capture and archive all internal systems access including any failed authentication attempts.
Intrusion Detection: Our servers are proactively monitored for any malicious intrusion attempts.
Storage Security
Backup Frequency: Backups occur bi-hourly internally, and daily to a centralized backup system for storage in a separate data centre cluster in Canada.
Organizational & Administrative Security
Employee Screening: We perform background screening on all employees. Staff who have access to customer data agree to our internal privacy policies.
Training: We provide security and technology use training for employees.
Service Providers: We screen our service providers and bind them under contract to appropriate confidentiality obligations if they deal with any user data.
Access: Access controls to sensitive data in our databases, systems and environments are set on a need-to-know / least privilege necessary basis.
Audit Logging: We maintain and monitor audit logs on our services and systems.
Information Security Policies: We maintain internal information security policies, including incident response plans, and review and update them as required.
Software Development Practices
Stack: We code in PHP and run on MySQL Server and Linux (LAMP). Our servers are built on CentOS.
Coding Practices: Our developers use best practices and industry-standard secure coding guidelines to ensure secure coding.
Information Security Incident Management
Despite best efforts, no method of transmission over the Internet and no method of electronic storage is perfectly secure. We cannot guarantee absolute security. However, if we learn of a security breach, we will notify affected users so that they can take appropriate protective steps. Our breach notification procedures are consistent with our obligations under various provincial and federal laws and regulation, as well as any industry rules or standards that we adhere to. Notification procedures include providing email notices or posting a notice on our website if a breach occurs.
Click to read our public Information Security Breach Policy.
Your Responsibilities
Keeping your data secure also depends on you ensuring that you maintain the security of your data by using sufficiently complicated passwords and storing them safely. You should also ensure that you have sufficient security on your own systems, if you use them to connect to our infrastructure. We offer SSL to secure the transmission of data between your devices and our infrastructure, but it is your responsibility to ensure that your hosting accounts are configured to use that feature (where appropriate).
Data Protection: PIPEDA and PHIPA Compliance
We adhere to the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how private sector Canadian organizations collect, use and disclose personal information in the course of commercial business.
Our infrastructure is physically located in Canada. We have no affiliates outside of Canada, and no foreign body has authority to compel the production of information.
We are compliant with PIPEDA (The Personal Information Protection and Electronic documents Act) which helps companies meet the mandatory provisions of the protection of person information. These provisions include, but are not limited to, the following:
- Consent must be garnered for collection of personal information
- Collection of personal information limited to reasonable purposes
- Limits use and disclosure of personal information
- Limits access to personal information
- Stored personal information must be accurate and complete
- Designates the role of the Privacy Officer
- Policies and procedures for breaches of privacy
- Measures for resolution of complaints
- Special rules for employment relationships
We are PHIPA (Personal Health Information Protection Act) compliant. PHIPA is comparable to HIPAA (Health Insurance Portability and Accountability Act) and is often considered the Canadian equivalent. Customers should note that as part of the PHIPA compliancy, information stored and user consent is given to the data provider (i.e you) that obtains and maintains the data, not the hosting provider. MarketAccess Communications is 100% Canadian owned and operated and all servers and infrastructure are located in Canada.
As the IT service/hosting provider, we fulfill the requirements indicated by the Information and Privacy Commissioner of Ontario (www.ipc.on.ca). We ensure the following:
- Send a notification of any privacy breach to the custodian as soon as possible
- Provide a plain language description of our services
- Prepare an audit trail feature to track the use of our database
- Have our own written privacy policies (read our Privacy Policy)
- We offer optional 256bit-AES Data at Rest Encryption on our all our Enterprise packages, for clients who will be collecting sensitive data and need to meet the requirements of PHIPA (Personal Health Information Protection Act).
MarketAccess Communications is Federally incorporated and is 100% owned and operated in Canada.