Commercetools Platform This White Paper Applies to the Commercetools Platform Running in Europe, the US and APAC
Total Page:16
File Type:pdf, Size:1020Kb
Information Security White Paper commercetools platform This white paper applies to the commercetools platform running in Europe, the US and APAC www.commercetools.com Table of Contents Introduction 3 What is commercetools? 4 Security Culture 4 Information Security Management Information Security Controls Human Resource Security Physical Security 5 Data Center Offices commercetools Platform 6 System Overview API Security Payment API Product Security Data in Transit Data at Rest Data Access Restrictions Separation of Production and Non-Production Environments Operational Security 8 Network Security Vulnerability Management Patch Management Malware Prevention Monitoring Incident Management Security in Development Process 10 Performance Management 10 Data Backup and Business Continuity Management 10 Supplier Relationships 11 Compliance 11 Data Processing Agreements International Data Transfer Data Protection Officer Information Security Certifications Conclusion 12 Introduction From the world’s largest public companies to early-stage startups, people rely on the commercetools ecommerce platform to run their business. Using the platform, companies can provide customers with detailed product data and create and update carts. Order data and customer data are then managed together in the platform. Thus, it’s mission critical for all our merchants that the commercetools platform - especially its API - is running nonstop. But, providing a reliable solution is only the first step. commercetools must also follow the latest information security best practices and comply with privacy regulations. This allows all companies to securely run their business on commercetools. We believe that transparency in security processes and controls is indispensable. For our customers it is important to know who can access their data when, and what measures are taken to prevent unauthorized access. This white paper provides a behind-the-scenes look at our security measures and how they protect our customers around the world. Information Security White Paper commercetools platform 3 What is commercetools? Our headless commerce platform separates frontend and backend functionality, enabling businesses to create seamless shopping experiences across all digital touchpoints. Our flexible API lets you engage with your customers via webshops, mobile apps, voice assistants, AR/VR applications, social networks, and others. We offer a catalogue of 300+ API endpoints for your commerce projects which you can consume à la carte. Our modular architecture enables you to rapidly build new customized services for your customers, iterate quickly, and run new business models at a global scale. Security Culture Information security plays a very important role for commercetools, as well as for our customers and partners. To this end, a framework of governance, risk management and compliance monitoring has been established, based on industry standards as well as applicable data protection laws. Information security is therefore an integral part of the commercetools corporate strategy. commercetools customers own their data, and we commit to keeping our customers data confidential. We offer our customers a detailed data processing agreement which describes our commitment to protect personal data of end-users. It states that commercetools will not process data for any purpose other than to fulfill our contractual obligations. Data will be deleted upon request, including backup and log/monitoring data. Finally, we provide data portability so customers may take their data with them if they choose to stop using our services, without penalty or additional cost imposed by commercetools. Information Security Management commercetools takes numerous steps to protect our employees, customers, partners and service providers from risks associated with information processing. We have implemented an industry-based standard Information Security Management System (ISMS) to regulate the handling of information across the organization. Information Security White Paper commercetools platform 4 Information Security Controls The effectiveness and efficiency of the ISMS is reviewed by the Information Security Officer (ISO) as part of internal and external audits as well as annual penetration tests, according to industry standards. Human Resource Security Personnel security measures are designed to reduce the risk of human error, theft, fraud or misuse of facilities. These include measures for internal and external employees as well as service providers. They cover measures in the recruitment phase, during the employment relationship and after termination. commercetools requires all employees and contractors to sign a confidentiality agreement before commencement. Security and Privacy awareness training is regularly delivered to all commercetools members. Physical Security Appropriate measures for the protection of property (perimeter protection, burglary protection) are implemented to prevent both unauthorized access and damage to commercial buildings and information. These also define measures that protect against loss, damage or compromise of assets and disruption of business activity. Data Center The commercetools platform is hosted globally on Google Cloud Platform (GCP) or Amazon Web Services (AWS) and guarantees the implementation of measures according to the red security level. Both cloud service providers operate state-of-the-art data centers that focus on security and protection of data among the primary design criteria. This is demonstrated by ISO/IEC 27001 certificate and SOC II reports. Offices commercetools has a security program that manages visitors, building entrances and overall office security. Access to commercetools offices is restricted and monitored by receptionists, who are also responsible for visitor management. According to our security zone concept, some areas are locked, and visitors must be guided by employees. Our office buildings are protected by a sophisticated fire alarm system. All fire extinguishers are co2 based to protect the hardware in use and all affected IT systems. Information Security White Paper commercetools platform 5 commercetools follows a clean desk policy and requests locking access to all devices, such as laptops and cell phones, are encrypted and password protected. commercetools Platform System Overview The commercetools platform is a visionary headless commerce SaaS (software-as-a-service) offering best suited for microservices architecture. It is available on different cloud solutions – like GCP and AWS. The application is containerized and supports auto-scaling to provide for high availability. Business User Tooling BringYourUIs Merchant Center SDK(Optional) Global Load Balancingand CDN API Back-end Storage CloudInfrastructure API Security The API of the commercetools platform is only accessible with a valid OAuth2 token that has a short period of validity. These tokens are created by our OAuth2 service and hold specific permissions defining which data can be accessed or modified. Information Security White Paper commercetools platform 6 Payment API No payment information must be made available on our platform. We only offer a payment API to reference a payment transaction. This means that this information can later be transferred to an ERP system for further processing with an order. A possible implementation in a frontend is completely independent of the commercetools platform and must run in an infrastructure provided by the customer or the payment service provider. It is recommended to build checkout frontend implementations that comply with a PCI-A level certification. Product Security One focus of commercetools’ security initiatives is to build and run the commercetools platform in a way to always protect our customers’ data. As a multi-tenant solution, we also ensure the highest level of data separation within the platform by storing the data of each project in a separate database. Projects are only accessible by the customer who created them. Full isolation and segregation of persistent data are ensured and regularly checked. Data in Transit We selected the software stack to create the commercetools platform that was designed and built to operate securely. Using the principles of ‘defense in depth‘, we’ve chosen cloud service providers with an IT infrastructure that is more secure and easier to manage than more traditional technologies. All communications are only available via HTTPS and are secured by TLS 1.2. It is not possible to access any data in the commercetools protocol using a non- TLS secured method. Data at Rest All data at rest is protected by hard disk encryption using AES-256. The central key management service of each cloud service provider is configured to encrypt data before it is written to physical storage. Keys are automatically rotated and provide an extensive audit log. Backups are encrypted via GPG (Gnu Privacy Guard) keys and separated from production. All user passwords are securely encrypted with state-of-the-art algorithms; never stored in plain text. Information Security White Paper commercetools platform 7 Data Access and Restrictions The authorization process is subject to the principles ‘need to know’ and ‘least privileges’. The detail of the role is set and documented by the asset owner (administrator) and approved by the team lead. This will be updated in the event of function change or personnel changes. Regular review processes are defined and carried out. Separation of Production and Non-Production