Table of Contents

Technical Security Overview

Read Time: 3 mins

1.0 Purpose

This document provides an overview of Sonar Software’s security technologies, policies, and best practices. It addresses the most common questions and areas of importance for our valued business partners.

This information is highly confidential and may only be shared with proper authorization. If you require additional details, please contact your Sonar representative.

2.0 Information Security

2.1 Cloud Security

Sonar leverages Microsoft Azure and DigitalOcean for secure, reliable cloud services. These platforms meet a wide range of international and industry-specific compliance standards, including:

  • Microsoft Azure: SOC 1, SOC 2, GDPR, CSA STAR, HIPAA, FedRAMP
  • DigitalOcean: SOC 1, SOC 2, CSA STAR

For further information, please visit:

2.2 Network Security

Sonar employs advanced network security measures to protect systems and data, including:

  • Network Controls: Azure Network Security Groups (NSGs) for controlled access to private VNets.
  • Threat Monitoring: Extended Detection and Response (XDR) for real-time monitoring of vulnerabilities and threats.
  • Intrusion Protection: Systems to defend against malware, brute-force attacks, SQL injection, Denial of Service (DoS), and Distributed Denial of Service (DDoS) attacks.
  • Centralized Logs: Logging of all services and audit trails for system changes.
  • VPN Administration: Secure remote administration of servers.

2.3 Data Security

Data protection is a cornerstone of Sonar’s operations:

  • In Transit: Data is transmitted via HTTPS using TLS 1.2 or higher.
  • At Rest: Data is encrypted using AES 256-bit encryption.
  • Geographic Data Residency: Flexible data residency options for compliance with regional requirements.
  • Tokenization: Sensitive payment data is tokenized to ensure security.

2.4 Physical Security

Sonar’s applications are hosted on Microsoft Azure in state-of-the-art regional data centers, featuring:

  • Multiple layers of authentication, including biometric access.
  • 24/7 surveillance and monitoring by security personnel.
  • Stringent restrictions on physical access to facilities.

2.5 User Controls

Access to Sonar sessions is managed by customer-designated Super Administrators, with features including:

  • Role-based access controls.
  • Granular permissions for user roles.
  • Enforced session timeout policies.

3.0 Application Security

3.1 Secure Development Practices

Sonar’s application security practices include:

  • Peer-reviewed code check-ins.
  • Password complexity requirements.
  • Session controls to enforce data security.
  • HTTP security headers for protection against web vulnerabilities (e.g., XSS, X-Frame-Options).

3.2 Penetration Testing

Sonar conducts annual independent penetration testing to identify and mitigate vulnerabilities, ensuring the integrity of our defenses.

4.0 Technology Governance

4.1 Compliance

Sonar is actively pursuing SOC 2 compliance, reflecting our commitment to protecting customer data and meeting international privacy and security standards. Our platform aligns with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), PIPEDA (Personal Information Protection and Electronic Documents Act), and the NIST Cybersecurity Framework (CSF).

4.2 Privacy Practices

Sonar’s Privacy Management Program is designed to comply with global requirements, including GDPR, CCPA, and PIPEDA. Highlights include:

  • Encryption: Tokenization for secure handling of sensitive data.
  • Vendor Compliance: Data storage providers meet the highest levels of compliance.

4.3 Operational Management & Access

Sonar may require temporary access to customer data for support purposes. When required:

  • Customer Administrators grant access on a per-case basis.
  • Access is revoked by the customer once the support issue is resolved.

Employee access to user data is strictly controlled and permitted only under defined circumstances outlined in our Privacy Policy.

How did we do?

Sonar's Security Strategies

Contact