Security portal
You can find Athento's security portal at https://athento.trustcenter.sprinto.com
Vulnerability prevention
For vulnerability prevention, Athento takes the following measures:
- Secure Code
- Security Measures of the Datacenters used
- Hardening measures
- Antivirus Policy
- Automated ethical hacking tests: Athento uses tools such as Detectify that perform automated security tests on the application and databases and scan assets for vulnerabilities, including OWASP Top 10, CORS, Amazon S3 Bucket and DNS misconfigurations.
- Bug Bounty Program: Athento actively recruits ethical hackers whose purpose is to discover software vulnerabilities.
- Penetration test for Enterprise customers: Customers on Enterprise plans can request scheduled ethical attacks so that their security teams can verify that Athento complies with the main security standards in the market.
Risk Assessment
Athento has a risk assessment system in accordance with the ISO 27001 and SOC 2 Type 2 standard. Likewise, it has a self-assessment report in accordance with what is established by the Cloud Security Alliance. This report is reviewed annually. This report is available only to Athento's enterprise customers upon signature of an NDA.
Procedure for possible vulnerabilities
If you find a technical vulnerability, please report it as soon as possible to soporte@athento.com
The scope of security incidents that you must report to Athento are those that affect any system maintained by Athento and those that may compromise information that could facilitate access to Athento or information that could be exploited in a potential attack on Athento's systems. For example, if a system that is not maintained by Athento is compromised but credentials or data that may compromise Athento are stored in it, you must report the security incident. Also included in the scope is any incident related to the technologies of Athento's technology stack.
You must not disclose information about the incident to any person or media other than Athento or the security officers of your company.
Athento will respond within the target time period according to the SLA contracted by the customer or established in the security standards.
When a potential security problem is detected, Athento will take the following steps in response to the incident:
- Assess the scope and severity of the problem
- Perform a product update as soon as possible that resolves the potential risk.
- Once the vulnerability is detected and known, we will inform our customers about the update and/or remediation performed.
Procedure to report security events
To report a security event, send an email to soporte@athento.com to create a support ticket.
Through said email you will be kept informed of any reported event.
If Athento needs to inform a customer about a security event, it will create a support ticket including the customer's security contact among the recipients.
Procedure to request digital evidence
If the customer needs any digital evidence (logs), they can consult them in the tool itself or send an email to soporte@athento.com to create a support ticket through which they will be given information to obtain said evidence.
Procedure to request information on legal requirements
If the customer needs any information about the legislation applicable to the cloud service, they can consult it by sending an email to soporte@athento.com to create a support ticket through which they will be given information on the legislation applicable to the service.
Procedure for intellectual property rights complaints
If you need to file a complaint about intellectual property rights applicable to the cloud service, you can do so by sending an email to soporte@athento.com to create a support ticket. Through this support ticket you will be given a response and follow-up.
Security Notifications
For our team, the priority is to resolve any service vulnerability as soon as possible. As soon as they are detected, they will be published in the Release Notes of the version that contains said vulnerability.
Once the possible vulnerability has been resolved, we will carry out a notification via email in which customers will be advised that the vulnerability has been resolved and details about its resolution.
The email will be sent to all authorized support contacts.
In case possible data loss is detected, affected customers will be notified immediately, and they will be notified of the measures to be carried out to resolve their situation.
Severity Level of Notifications
The notifications will also indicate the severity of the resolved vulnerability. The vulnerability levels are described below.
- Compromise of data hosted in the cloud
- Compromise of the production server
- There is a risk of denial-of-service attack (legitimate users are prevented from accessing the system due to an attack).
How to Report Possible Vulnerabilities
Any incident or vulnerability detected must be communicated immediately through the contact mechanisms of our support service.