Table of Contents

Sonar's Security Strategies

Read Time: 3 mins

Security is a Top Priority

At Sonar, trust is at the core of everything we do. We are committed to providing a platform for ISPs that prioritizes data security and privacy. With industry-leading safeguards and continuous monitoring, our customers can rest assured that their data is protected 24/7 in the cloud.

Security in the Cloud

Sonar leverages the robust security of Microsoft Azure and DigitalOcean to safeguard client data in the cloud.

Our cloud platforms adhere to stringent international and industry-specific compliance standards, including:

  • SOC 1, SOC 2
  • General Data Protection Regulation (GDPR)
  • HIPAA, FedRAMP, CSA STAR

These certifications are verified through rigorous third-party audits to ensure adherence to security controls. Data is hosted in regional, state-of-the-art data centers designed for mission-critical systems with:

  • Fully redundant subsystems.
  • Compartmentalized security zones.
  • Multiple layers of authentication, including two-factor biometric access.
  • 24/7 surveillance by dedicated security personnel.

Data Security: Industry Standard Encryption and Secure Connections

  • In Transit: Data is encrypted using TLS 1.2 or higher.
  • At Rest: Data is encrypted with AES 256-bit encryption.
  • Geographic Residency: Flexible data residency options are available.
  • Tokenization: Sensitive payment data is tokenized for added security.

Network Security: Intrusion Detection and Prevention

Sonar employs robust network security measures, including:

  • Firewalls configured for best practices in ingress and egress security.
  • Extended Detection and Response (XDR): Real-time monitoring for threats like malware, brute-force attacks, SQL injection, and DoS/DDoS attacks.
  • Centralized logging and monitoring for potential security events.
  • Network and application vulnerability scanning.

Access Controls and Data Governance

Sonar’s platform includes granular-access permissions and role-based governance:

  • User Roles: Group permissions define which actions users can perform.
  • Permissions: Permissions are customizable within each module.
  • Modules: Functional areas of the platform are managed independently.

Sonar is actively working toward SOC 2 compliance, demonstrating our dedication to security and privacy.

Our Shared Security Partnership

Security is a shared responsibility. Sonar connects to your technology environment, making collaboration essential for maintaining security.

  • Customer Responsibilities:
    • Secure database access (e.g., IP whitelisting, TLS encryption, SSH tunneling).
    • Implement restrictive user permissions within your Sonar instance.
  •  Sonar Responsibilities:
    • Ensuring code quality and secure development practices.
    • Continuous monitoring and vulnerability scanning.

Data Utilization and System Monitoring

Sonar uses first- and third-party tools to enhance our platform and services:

  • Usage Analytics (Pendo): Helps improve the platform based on user interactions.
  • Configuration Backups: Securely encrypted and stored for redundancy.
  • Error Reporting: Internal systems collect runtime data to diagnose issues.
  • In-Product Messaging (Pendo): Provides personalized, pseudonymized user guidance.

Corporate Security

Personnel and Policies

  • Dedicated Information Security team led by the Lead Information Security Engineer.
  • Comprehensive security policies reviewed and approved by leadership.
  • Background checks for all employees.
  • Regular security training for staff.

Incident Response

  • 24/7 Monitoring: Security and DevOps teams are on-call for immediate response.
  • Incident Response Plan: Comprehensive and regularly tested.
  • Training: Staff receive ongoing education on incident escalation and response.

Product Security

Development Practices

  • Peer-reviewed code development and secure software lifecycle processes.
  • Automated tests targeting injection flaws, input validation, and CSRF token usage.
  • Regular penetration testing to identify and mitigate vulnerabilities.

Monitoring and Authentication

  • Multi-layer authentication for access to back-end systems.
  • Logging and monitoring for all access and potential anomalies.
  • Reputation monitoring and threat intelligence checks.

How did we do?

Sonar and General Data Protection Regulation (GDPR)

Technical Security Overview

Contact