Talent Rover LLC is committed to protecting the privacy of our users and their data. Customer security is the foundation of customer success, so Talent Rover will continue to implement the best practices and technologies in this area. With this as a core value, we have built our product on the industry leading Salesforce.com Platform.
Talent Rover Internal Controls
Administrative Safeguards
- Comprehensive information security and privacy policies designed to meet the requirements of SOC2 and to reflect Talent Rover’s contractual commitments to safeguard customer data and regulatory requirements.
- Designated professionals, led by the Chief Security Officer, who is responsible for the Company’s security program.
- Limiting access to Customer Data to personnel who require such access to perform Talent Rover’s contractual obligations.
- Employees are required to complete Security Awareness Training one month from the date of hire and additional training on an annual basis.
- Security policy includes background checks for all employees globally.
- A formal code of conducts in place for employees, suppliers/vendors and customers.
- Formal review and approval process for Security, Availability and Confidentiality Policies to ensure all are current and enforced.
- Security staff reviews all risk assessment findings and determines mitigation strategies needed. CSO formally approves all changes made to security, availability, and confidentiality policies.
Technical Safeguards
- Full redundancy on all system that are related to the Talent Rover service offering.
- Logical network security, including stateful firewalls and intrusion detection systems.
- Vulnerability assessment reports are gathered and reviewed.
- Workstation policies that require employees to store confidential information in secure locations, unattended workspaces to be secured, screens of unattended computers to be locked, and all portable computer disk drives fully encrypted.
- Dome9 is used for security monitoring of the environment.
- All password requirements are enforced and fully documented.
- Access to all environments that contain customer data or are related to the Talent Rover product is maintained with Okta, a secure identity management, and single sign-on application. This includes two-factor authentication.
Salesforce.com
Datacenters
Service is collocated in dedicated spaces at top-tier data centers. These facilities provide carrier-level support, including:
Access Control and Physical Security
- 24-hour manned security, including foot patrols and perimeter inspections.
- Biometric scanning for access.
- Dedicated concrete-walled Data Center rooms.
- Computing equipment in access-controlled steel cages.
- Video surveillance throughout facility and perimeter.
- Building engineered for local seismic, storm, and flood risks.
- Tracking of asset removal.
Environmental Controls
- Humidity and temperature control.
- Redundant (N+1) cooling system.
Power
- Underground utility power feed.
- Redundant (N+1) CPS/UPS systems.
- Redundant power distribution units (PDUs).
- Redundant (N+1) diesel generators with on-site diesel fuel storage.
Network
- Concrete vaults for fiber entry.
- Redundant internal networks.
- Network neutral; connects to all major carriers and located near major Internet hubs.
- High-bandwidth capacity.
Fire Detection and Suppression
- VESDA (very early smoke detection apparatus).
- Dual-alarmed, dual-interlock, multi-zone, pre-action dry pipe water-based fire suppression.
Secure Transmission and Sessions
- Connection to the Salesforce environment is via TLS cryptographic protocols, using global step-up certificates, ensuring that our users have a secure connection from their browsers to our service.
- Individual user sessions are identified and re-verified with each transaction, using a unique token created at login.
Network Protection
- Perimeter firewalls and edge routers block unused protocols.
- Internal firewalls segregate traffic between the application and database tiers.
- Intrusion detection sensors throughout the internal network report events to a security event management system for logging, alerts, and reports.
- A third-party service provider continuously scans the network externally and alerts changes in baseline configuration.
Disaster Recovery
- The Salesforce service performs real-time replication to disk at each data center and near real-time data replication between the production data center and the disaster recovery center.
- Data are transmitted across encrypted links.
- Disaster recovery tests verify our projected recovery times and the integrity of the customer data.
Backups
- All data are backed up to tape at each data center, on a rotating schedule of incremental and full backups.
- The backups are cloned over secure links to a secure tape archive.
- Tapes are not transported offsite and are securely destroyed when retired.
Internal and Third-Party Testing and Assessments
Salesforce.com tests all code for security vulnerabilities before release and regularly scans our network and systems for vulnerabilities. Third-party assessments are also conducted regularly:
- Application vulnerability threat assessments
- Network vulnerability threat assessments
- Selected penetration testing and code review
- Security control framework reviews and testing
Security Monitoring
Our Information Security department monitors notification from various sources and alerts from internal systems to identify and manage threats.