Security Overview
Multi-Tenancy
All customers are assigned a Monolith "Tenant" - a tenant is a logical unit that separates every set of customer data into their own silos.
In Monolith, each customer is given thier own database and logical file storage area in our block storage. This means that data you enter into Monolith is not commingled with data from other customers.
The same idea applies to files uploaded into Monolith. Files stored in Monolith are stored in thier own logical silo based on the cutsomer tenant.
Data Export
This Multi-tenant infrastructure also means that it is very easy to get a copy of your data - just make a support request!
Encryption
All data stored in Monolith is encrypted at rest using AES-256 bit encryption algorithms. This includes data stored in databases, on servers, and in file object storage.
All data in transit to, from, or wihtin Monolith is also encrypted using HTTPS and TLS encryption standards/protocols.
While this data is encrypted, the encryption is controlled by us, which means a few select people from the Monolith team have access to customer data. This access is only granted for support and maintenance purposes.
Security Operations Policy
Monolith has an internal Security Operations Policy and Data Management Policy that covers our internal standards in more detail. If you would like to see it, please submit a request to support.
Cloud Hosting
Our Monolith infrastructure is currently hosted in AWS.
More specifically, we currently have 3 cloud infrastructure endpoints, which are all hosted on AWS: US East, London (UK), and Sydney (Australia)
Our United States endpoint is currently hosted in the AWS GovCloud East Region.
The AWS GovCloud infrastructure has some specific security policies in place that differs from normal AWS regions. These policies can be reviewed at the link below:
Data Backup
Database Backups
Monolith data within our databases is backed up every 24 hours. We keep a 30 days of backups which allows us to recover data from up to 30 days in the past.
We also typically create manual database backups for any major updates that require database maintenance.
These backups are stored in an encrypted format within a separate region from the current database. This allows for recovery of data in the event of an AWS region outage.
File Object Storage Backups
Files uploaded to our Object Storage system implement typical object storage versioning. This means that a deleted file can be recovered by restoring one of its versions. A new file version is created and stored in the event of a file overwrite, which can occur when a file with the same name and path of another file is uplaoded.
These file versions are kept for up to 90 days after deletion.
Basic Cloud Infrastructure
The following diagram illustrates the basic cloud infrastructure of the Monolith cloud environment. This is just an illustration to show how nodes communicate and share data/information:
Vulnerability Scans
The Monolith cloud infrastructure has network and system level scans that occur every 24 hours to test for network and system vulnerabilities. These scans produce reports that can be review for any issues or characteristics that are not inline with our security baseline.
A/V - Malware Detection
All of our endpoints, including employee systems, are monitored using Crowdstrike Falcon. This provides continious 24/7 monitoring of our endpoints for threat detetion and allows for immediate remediation.
Penetration Testing
We conduct annual pentests of Monolith that test for common infrastructure vulnerabilities, configuration issues, and application vulnerabilities. These pentests are conducted by an independent 3rd party. The testing targets our development and staging environments and not the customer facing production system to avoid interrupting services and prevent any potential access to customer data.
Customer may request a copy of our latest pen test reports by contacting support at support@monolithforensics.com
Logging
Various system logs are currently managed by logging services within AWS and Datadog. These logs are currently aggregated within Datadog, which allows for periodic review.
Last updated
