Security Overview

Simana is the leading web-based platform for quality improvement. All quality improvement relies on data.  That’s why, in order to protect the data entrusted to us, we operate an array of security controls and protocols. 

• Reliability & Availability
• Application Security
• Information Governance
• Datacentre Protections

Availability

Our goal is to ensure continuous availability of the Simana platform. We have measures in place to ensure the solution remains constantly available and aim to achieve 99.9% availability. Our team are on duty 24 hours a day and are backed up by AWS' datacentre team dedicated to maintaining constant service availability. 

Back ups 

All data saved in Simana is backed up on a consistent and recurring basis.  This includes the utilisation of frequent server instance backups, data redundancy replication, and multi-region/availability zone deployment architectures. 

Redundancy 

We utilise redundancy through AWS availability zones meaning that, in case of failure, customer data traffic is moved away from the affected area to another availability zone in the same region. 

Encryption of data 

Encrypted in transit  

All user interactions with the Simana platform (e.g. logins, browsing pages, api calls etc) are protected with top end in-transit encryption. They are encrypted in-transit with either TLS or SSL with RSA 2,048 bit keys or better.

Encrypted at rest  

Simana leverages several technologies to ensure stored data is encrypted at rest. Physical and virtualised hard drives used by Simana product server instances as well as storage solutions like AWS Elastic File System use AES-256 encryption. Additionally, certain databases or field-level information is encrypted at rest, based on the sensitivity of the information. For instance, user passwords are additionally hashed.

Encryption keys  

Encryption keys for both in-transit and at-rest encryption are securely managed. SSL & TLS private keys for in-transit encryption are managed through our certificate provider. Volume and field-level encryption keys for at-rest encryption are stored in a hardened Key Management System that uses HSMs validated to FIPS 140-2. Keys are rotated, and the frequency varies by the type of key and the sensitivity of the key and the data it protects.

Simana performs internal audits and engages with industry-recognised providers for external audits. 

Simana engages twice annually with industry-recognised providers for application and network penetration testing. 

Passwords must be 9 alphanumeric characters with at least 1 uppercase, 1 lowercase, 1 special (@,£,%) and 1 number. 

Data ownership

Data privacy

Data sharing

Simana does not share content data with third party organisations. Certain personal data is shared with our CRM and Support software provider to enable us to identify users whilst providing support services, such as live chat and email and to contact users with relevant information to their use of our services.

Physical security 

Data location