Skip to main content
Security

Security standards

How HighCohesion protects your data: authentication, encryption, hosting, network security, and user roles.

The short answer

HighCohesion hosts all of its services in AWS data centres in eu-west-1 (Dublin), inside a private network. Your data is encrypted at rest with AES-256 and in transit with TLS 1.2+ or SFTP. Control Panel accounts are sponsored by an existing user in your organisation, require a business email address and have MFA enforced for every user. All user activity and platform access is logged, and all services are monitored 24/7.

How it works

Where HC's services run

All HighCohesion services are hosted in physically secure, private data centres managed by AWS in eu-west-1 (Dublin).

HighCohesion provides two complete environments: a test environment for validating integrations and running UAT tests, and a live environment.

Servers are protected by a private network with inbound restrictions. Internal services are accessible only within HC's private VPN.

How your account is created and secured

Control Panel accounts are set up via sponsorship: a new account must be requested and sponsored by an existing user within the same organisation. Only business email addresses are accepted; personal email accounts (for example Gmail, Outlook or Yahoo) are not permitted.

To access the platform for the first time, request it via direct email or by creating a support ticket at support@highcohesion.com. The HC support team reviews and approves your request, then creates an account under your organisation. You receive a one-time login link via email. After clicking that link, you must set a new password and configure MFA.

All users have MFA enforced, including admins.

Passwords are encrypted using encryption algorithms with up to 448-bit keys. Sessions last 10 hours to maintain a fresh login cache. After the cache expires, you must log in again by entering your username and password, followed by the MFA flow.

Starting 1 April each year, HC performs a Control Panel account review. Any user with no login activity in the previous 60 days is removed.

User roles and permissions

HighCohesion uses three permission roles for individual organisations: Owner, Operator and Viewer. An Owner can access all features necessary to configure and set up a stream, such as keys, source, transformation and destination functions. An Owner can also create, edit and revoke users within their own organisation. A Viewer can only view system configurations and event and job reporting, so they can access the Control Panel without the risk of making unwanted edits to the live environment.

To ensure data segregation, data for a particular organisation is accessible only by a unique organisation ID. Data is passed by first authenticating as the organisation, giving access only to data related to that specific organisation.

How connections to HC are secured

All customer and partner connections to the HighCohesion platform are encrypted using TLS 1.2+ or SFTP (SSH) for secure data transmission. Data encryption in transit is optional when SFTP is used in combination with the PGP encrypt/decrypt protocol.

HC's VPN is restricted to HighCohesion employees only. Database access is never exposed publicly.

All resources are deployed within private subnets with network-level isolation, and cross-zone load balancing is enabled with load balancers for high availability without public exposure.

What data HC stores and how it is encrypted

HC stores three types of data, all accessible only from within its private network:

  • Configuration data: stored in AWS RDS instances

  • Transaction information: stored in MongoDB Atlas instances

  • System keys and customer data: order and product files stored in private Amazon S3 buckets

All data is encrypted at rest using server-side encryption (SSE) with AES-256 keys.

Personal account information

Personal details you provide when creating a HighCohesion account, such as your name and email address, are stored for as long as your account remains active. You can request account deletion at any time, and this data will be removed from HC's systems.

Personally identifiable information (PII)

HC uses a number of different tools to help track usage of the product, such as raw server logs. These tools may receive personally identifiable information such as your computer's IP address and, in some cases, your name and/or email address. Raw server logs are not stored for more than 14 days and, in line with GDPR, you can request that any PII HC stores is removed from its systems and from any sub-processors it employs.

Authentication data

To enable workflows to process data between third-party services on your behalf, HC requires you to provide authentication credentials such as usernames, passwords and access tokens. This sensitive authentication data is encrypted at rest in HC's databases using 256-bit encryption and is removed when you delete your HighCohesion account. All sensitive authentication data is obfuscated when passed through stream execution state and logs. Only HighCohesion admin users have access to this information. HC can share this information with customers or partners only under a support request at support@highcohesion.com.

Stream data

HC stores stateful data as part of the integration execution process for post-execution logging, root cause analysis (RCA) and error resolution. Detailed execution data and log information are retained only as long as necessary. Stream log data viewable by customers in the Logs view of each stream is stored for 14 days before deletion. Stream execution data, including payload in, payload out and transformation files, is stored for 60 days before being erased. Designated HighCohesion and partner staff can access this data when needed for their role.

Logging, monitoring and alerting

All user activity on the platform is logged, including actions taken, data modified and timestamps. HC also logs every access to the platform, recording the time, IP address and machine name from which the request originated.

All logs are stored for 14 days in HC's internal logging system. Only internal team members have access to this service.

HC monitors all services 24/7. Alerts are caught internally and customers are notified via email.

Incident response

For more information about incident management, see HC's Disaster Recovery plan.

What this means for you

  • To get a Control Panel account you need a business email address and a sponsor who already has an account in your organisation, and you must set a password and configure MFA on first login.

  • Your session lasts 10 hours; after that you log in again with your username, password and MFA.

  • If you have not logged in for 60 days when the annual account review runs from 1 April, your account is removed.

  • Stream logs are available in the Control Panel for 14 days and execution data (payload in, payload out, transformation files) for 60 days; after that they are erased.

  • You can request deletion of your account data at any time, and removal of any PII HC holds, in line with GDPR.

  • The credentials you provide are visible only to HighCohesion admin users, and HC shares them with you or a partner only through a support request.

  • When HC's monitoring raises an alert, you are notified by email.

Related

Was this helpful?

Still need help? Ask the team