HaystackID believes that security begins with the components that make our business work – people, process, and technology. Even before people, process, and technology, however, comes the ethics and integrity in which HaystackID was founded. The HaystackID business values are paramount to our overall controlled environment that secures our client’s data. Management reinforces our ethical and conduct standards by communicating with staff on a consistent basis and using real-life scenarios as teaching opportunities. Our overall security goals have been identified and are incorporated in security policies and communicated to employees. Roles and responsibilities for information security are provided within security policies and employees are familiarized with our high expectations and unwavering standards. Whether our employees are implementing old, current, or new technology, they follow established processes to strengthen our already steadfast foundation. HaystackID treats your data as if it was our own and our company depended on it – because it does.
HaystackID understands the inherent value of every client’s data, and the importance of maintaining the strictest levels of data security and integrity. Our systems and protocols provide multiple levels of security, designed to protect client data from any possible source of intrusion from the minute it comes into our control until its eventual destruction or other terminal action. HaystackID adheres to internationally recognized data security and privacy laws, such as US-EU/Swiss Safe Harbor, regarding the handling and use of client data and information, which covers network and data security, physical security, and processes and controls which govern the handling of client materials.
Network and Data Security
Every client engagement is treated with the strictest confidentiality, and HaystackID will consult with clients to define their particular security requirements at the outset of a project. One client’s data is never inter-mingled with that of another, and all Electronically Stored Information (“ESI”) is tracked and managed through the same evidence tracking system used by government and law enforcement agencies. HaystackID controls access to client data and matter information by employing network access controls with varying levels of user authentication, password policies, disk encryption, and standard access controls. Network systems are monitored around the clock for security intrusions, virus and worm threats, and potential hardware failure is supervised and mitigated by our internal cyber-security team. Network intrusion incident response plans and procedures are regularly updated to counteract and defend against the latest cyber-security threats. Processing and forensic workstations are regularly imaged to assure optimal system stability, reliability, and operational predictability. HaystackID maintains data on multiple physically separate redundant RAID arrays through our main processing array. All client media is backed up to insure against potential hardware failure or malicious intrusion. Should one of the redundant designs fail, it can be recovered from the remaining active arrays.
Once on our provided data array, edit and delete permissions are restricted to specific employee levels to ensure that data is processed and loaded exactly how it was received. Data is then loaded into our processing platforms, where other copies of the original files are extrapolated into a processing directory and meta-data and working files are copied into our mirrored SQL database clusters. As data travels through data processing applications, audit logs are created to ensure every document is accounted for. Each and every document is either removed because of client specified filters, it was an exception document and appears on the exception log, or it is delivered back to the client for review. Our SQL array is backed up every 24 hours, and we are able to offer specific back-up schedules for clients with the highest levels of redundancy demands. Finally, we keep another copy of all exported work product including review sets, productions, and forensic working files.
Password enforcement is an extremely important aspect of the HaystackID data security strategy. HaystackID, in order to protect the confidentiality of the materials maintained on its systems, requires the strictest password requirements, enforces a password history policy, a minimum length policy, and a password expiration policy. Each employee’s individual workstations are encrypted at the physical disk level, ensuring that even physical access to the hard drive of a machine does not guarantee access to data. Similar technologies are used on physical deliverables of data (hard drives, DVDs, thumb drives, etc.).
Further detailed information regarding the specifics of our network and data security can be made available after signing a Non-Disclosure Agreement.
All HaystackID locations are specifically chosen to serve as a first level barrier in the HaystackID security design. HaystackID operational facilities are not client facing, and while there are very rare exceptions where a current or prospective client would be allowed to access our secure facilities, access is strictly monitored and granted only through adherence to a meticulously governed security protocol, with all visitor access logged and recorded. Building access is restricted with key card security, and only granted to card carrying personnel or visitor pass carrying individuals who are escorted by an approved staff member during the duration of any visit. The offices of HaystackID are secured with an alarm system that is constantly monitored by an off-site, independent security organization. There are redundant motion detectors and numerous cameras on closed circuit recording in place to ensure office security during all hours, with video footage recorded and stored on a digital recorder which is maintained for a minimum of twenty-one days. Local data centers are secured with an independent keypad and monitored by the same independent security company. Access to these data centers is restricted to approved personnel only.
HaystackID employs advanced technology to track the movement of data throughout the entire litigation hold and Information Discovery Life Cycle in order to maintain Chain of Custody (“COC”) and evidence handling defensibility. We have purchased and deployed the same software utilized by government and law enforcement agencies to track client media and devices. All original client media is stored and checked in our forensic lab when it arrives at our facility. Physical access to the lab is controlled via keycard and pin number access, and media is stored inside fire, water, and bullet proof evidence safes in which evidence access is controlled and logged from check in to check out.
Beyond monitoring individual access, all HaystackID data centers are protected against possible environmental and disaster circumstances. The data centers are equipped with temperature and water sensors, which are also monitored around the clock. There is a holding quarter with a third independent keypad for data requiring additional levels of physical access security. The employees allowed access to this area change in accordance with the data located within.
Processes and Controls
With any organization, proper network and data security begins with paying meticulous attention to the team members who are allowed to hold the keys to client data. Regardless of how secure the network standards of an organization are, one malicious action from an internal user can undo all efforts designed to maintaining network security. Every prospective employee at HaystackID undergoes a fully comprehensive background check by a third party security organization as a part of the hiring process. Employees sign strict confidentiality and non-disclosure agreements, and are trained to adhere to internationally recognized data security and privacy standards regarding the handling and use of client data and information.
Data destruction compliance is specified by the client, or HaystackID will make recommendations based on your specific organization’s data security and privacy needs. HaystackID offers isolated stand-alone networks for premier clients that require SAS 70 compliance as a part of their data security package. Employees are granted access on an as-needed basis dictated by the employee’s assigned project role. Any changes in employee access needs to be authorized and approved by a Director level HaystackID employee.
Data Center Snapshot Certifications and Attestations
- International Traffic in Arms Regulations (ITAR) Compliance
- HIPAA and HIPAA HITECH Act Compliance
- SSAE-16 SOC II Compliance
- ISO 27001 Compliance
- ISO 14001 Compliance (Germany)
- ISO 9001 Compliance (Germany)
- PCI DSS Compliance
- EU-US and Swiss-US Privacy Shield Certifications
- General Data Protection Rule (GDPR) Adherence