Core Security

Understanding HaystackID Security

One of HaystackID’s primary focuses is to meet customer needs with offerings, processes, and protocols that protect the confidentiality, availability, and integrity of customer data. We do this through a three-fold information security approach that includes physical, network, and security policy layers. These layers of information security are applied to both internal and external environments and include both active and passive protection measures.

This information security approach provides our customers with trusted and reliable solutions so they can focus on the conduct of electronic discovery without having to divert focus to concerns on the security and privacy of electronically stored information. This approach has also been validated by certifications, attestations, and compliance audits.

As security is not an achievement but an ongoing process, HaystackID is committed to maintaining and validating the highest standards from CEO to contractor to ensure our customers have peace of mind that their data is secure throughout the entire information lifecycle.

Enterprise Environments and Equipment Security

HaystackID operates internationally, maintaining data centers across three continents. All HaystackID locations apply and monitor company security policies to ensure that only those qualified (employees, contractors, and visitors) to enter, access, and interact with customer data are able to access secure areas. These secure areas are locked and controlled through a combination of badged access controls, security cameras, and routine auditing to proactively prevent unauthorized access.

From a production environment perspective, data and equipment housed by HaystackID are located in our secure data centers. Our production sites reside in a dedicated and segregated portion of the data centers with additional physical security measures in place. All equipment resides in locked racks, with limited IT personnel having access for on-site maintenance. Additionally, our data centers are designed to compartmentalize any potential combustion events and address such events with full fire detection and suppression systems. Also, regular inspections are conducted to ensure the maintenance of physical protection of data center facilities from not only fires but also floods, earthquakes, explosions, civil unrest, and other potential disasters per SOC 2 Type 2 compliance requirements. Complementing this physical security layer are security policies that have been developed and are routinely tested to ensure no vulnerabilities exist on any level of our physical security structure. Additionally, removable media is only used in controlled areas, and removable media is tracked, managed, and stored following IT asset management standards and procedures. Unusable and retired physical media is managed to customer specification, including data removal, disablement (irrecoverable and inaccessible), and shredding by approved vendors.

Network Security: From Endpoint to Encryption

HaystackID employs numerous levels of security to ensure all data is protected from unauthorized access. Security measures include hardware firewalls for the networks, and multiple layers of security have been implemented to secure data with file system security encoded into the application layer of our software applications. All network links between offices and data centers are secure Multiprotocol Virtual Private Network (MPLS-VPN) links that maintain no public Internet visibility.

HaystackID also employs three levels of security to protect hosted applications from unauthorized access. External access is controlled by an SSL VPN for each user. Access to applications is controlled by group policy. Moreover, a project manager, in conjunction with the IT component of our operations team, determines and manages case access. Additionally, HaystackID uses multiple monitoring servers to monitor all Internet lines, firewalls (all ports), routers, switches, and servers. Critical application servers are also monitored. These network security elements, supported by our physical and policy layers of security, help ensure customer data’s confidentiality, availability, and integrity. From an access management perspective, HaystackID follows strict protocol from accessing servers, storage, network configurations and data in all enterprise environments.

HaystackID follows industry best practices by regularly revising certificates, keys, and passwords. We also leverage multi-factor authentication and endpoint encryption to augment our need-to-know, role-based data access model.

HaystackID also provides industry best practice support for crucial network security features. Details on these critical security features can be provided as required by our Operations and IT Team security experts to support Requests for Information (RFI), Requests for Proposal (RFP), and Requests for Security Verification.

Security Policies: Best Practices for Best Results

HaystackID security policies are developed and routinely tested to detect, identify, locate, report, and remedy any potential vulnerability in our security structure’s physical and network security layers. These policies are monitored and managed to minimize risk and provide customers confidence in all data security areas, from employee to enterprise and endpoints to encryption.