Plain-language summary
- We believe in strong security and utilize technologies such as multi-factor authentication, password managers, full-disk encryption, endpoint detection, central logging, least-privilege access and tested backups.
- Client credentials are kept in an encrypted password manager and used for the client's work; our administrative access to your systems is logged where the platform allows, and you can revoke it at any time.
- We review the providers we rely on, keep our systems updated, and review our own practices periodically.
- If something goes wrong we have an incident-response process, and we notify affected clients upon confirming a breach of their data.
- These practices map to the "reasonable safeguards" required by PIPEDA and BC PIPA.
This summary is provided for convenience only and is not part of the agreement. If anything in the summary differs from the full terms below, the full terms govern.
These Security Practices describe the kinds of safeguards RGB Technologies Inc. ("RGB") uses to protect its own systems and the customer information and systems it is entrusted with. They form part of the Terms of Service. They describe RGB's general approach; specific security commitments to a customer, such as notification periods or reporting, are set out in that customer's Signed Agreement or Order. RGB updates these practices as threats and technology change; the version at the top of this page is the one in effect.
1. Administrative safeguards
1.1 Accountability. RGB has designated a person responsible for its security and privacy program, who reviews the program periodically and after significant incidents.
1.2 People. Anyone working on RGB's behalf who may access customer information is bound by written confidentiality obligations, is given the access needed for their work, and has that access removed when the work ends. Background screening can be arranged where a client requires it.
1.3 Policies. RGB maintains written policies covering access control, credential handling, device security, vendor review, data retention and destruction, incident response, and backup and recovery, and reviews them periodically.
1.4 Vendor management. Before adopting a service that will handle customer information, RGB reviews its security and privacy posture, such as its certifications, data location and terms. RGB's current service providers are listed in the Privacy Policy.
1.5 Risk assessment. RGB assesses risks to customer information periodically and when it takes on a materially new kind of work.
1.6 Training. People working on RGB's behalf receive security awareness training, including recognizing phishing and social engineering.
2. Technical safeguards
2.1 Identity and access. RGB uses multi-factor authentication on its accounts, with phishing-resistant methods such as hardware keys or passkeys where available, and grants access on the principle of least privilege. Administrative access to client systems uses credentials separate from day-to-day accounts where practical, and is removed when the engagement ends or on the client's request.
2.2 Credentials. Customer credentials and secrets are kept in an enterprise password manager with audit logging and shared through its secure sharing features rather than through email, chat or documents. Secrets used by RGB software are held in a cloud secret manager and rotated when exposure is suspected.
2.3 Endpoint security. RGB's computers are configured with measures such as full-disk encryption, automatic updates, supported operating-system versions, screen lock and endpoint detection and response, with alerts reviewed by RGB.
2.4 Network. RGB systems communicate over encrypted connections. Administrative access to RGB infrastructure is restricted to authenticated users and devices, and public-facing services use a content-delivery and web-application-firewall provider.
2.5 Logging and monitoring. RGB collects security events from its computers, cloud accounts and key applications centrally, applies automated detection rules, and investigates anomalies.
2.6 Secure development. RGB develops software using version control, code review, dependency and vulnerability scanning, software bills of materials, signed builds and signed update channels. RGB applications are designed to keep customer data on the customer's own devices and accounts where the design allows (see the Software License Agreement).
2.7 Vulnerability management. RGB applies security updates to its systems promptly, prioritizing critical and actively exploited vulnerabilities, and periodically checks its cloud configurations against security benchmarks.
2.8 Backups and recovery. RGB keeps encrypted backups of its own systems and code, including an off-site copy, and tests restores periodically. Backups of client systems are performed where RGB has been engaged to do so, as described in the Order.
2.9 Data handling. Customer information is kept in the client's own systems where practical. Where RGB holds copies (for example, engagement records or files being processed), they are kept in encrypted, access-controlled systems, retained as described in the Privacy Policy, and securely deleted afterwards. Devices and media are securely erased before disposal.
3. Physical safeguards
RGB's workstations are encrypted and locked when unattended. RGB does not operate its own data centre; its cloud services are hosted by providers with independently audited physical security. Paper records containing customer information are kept to a minimum and shredded when no longer needed.
4. Working in your environment
When RGB accesses your devices, accounts or networks, RGB: uses the least privileged access that will do the job; keeps records of its work sessions and makes them available to you; logs its administrative actions where the platform allows; copies your data to RGB systems only where the work requires it and you have agreed; tells you if it needs to disable any of your security controls; and returns or destroys your credentials and data at the end of the engagement as described in the Terms of Service.
5. Incident response
5.1 RGB maintains an incident-response procedure covering detection, containment, recovery, notification and lessons learned.
5.2 If RGB confirms unauthorized access to, or loss or disclosure of, customer information in its possession or control, RGB will work to contain it, notify the affected client without undue delay with what is known and what is being done, provide the information the client reasonably needs to meet its own legal notification obligations, cooperate with the client's investigation, and keep a record of the incident.
6. Business continuity
RGB's systems and code are backed up off-site so that they can be restored to alternate hardware. With the client's permission, RGB keeps documentation of client environments so that another qualified provider could take over in an emergency at the client's direction, and clients may request a copy for their own continuity planning.
7. Assurance
On request, RGB will complete reasonable security questionnaires, provide reasonable evidence of its controls, and discuss its practices with your auditors or insurers.
8. Reporting a security concern
If you believe you have found a security vulnerability in an RGB product or system, please email support@rgbx.com. RGB will acknowledge reports promptly and will not pursue good-faith researchers who respect privacy and do not disrupt services.