{"id":28330,"date":"2022-09-21T12:02:15","date_gmt":"2022-09-21T12:02:15","guid":{"rendered":"https:\/\/phrase.com\/?page_id=28330"},"modified":"2024-11-11T15:00:28","modified_gmt":"2024-11-11T14:00:28","slug":"security","status":"publish","type":"page","link":"https:\/\/phrase.com\/security\/","title":{"rendered":"Security"},"content":{"rendered":"\n
\n\n\t\n\t
\n\t\t
\n\t\t\t

Phrase<\/p>\n

\n

Security<\/h1>\n<\/div>\n\t\t<\/div>\n\t<\/div>\n<\/div>\n\n\n\n\n\n\n
\n\n\t\n\t
\n\t\t
\n\t\t\t

Phrase Security Statement<\/h2>\n

Introduction<\/span><\/h3>\n

This security statement applies to the products, services and applications offered by Phrase. The protection and reliability of customer data is our utmost priority. Our security system is based on the principles of high resilience, transparency and third-party evaluation in accordance with the globally recognized security standards. We believe that Phrase architecture based on a public cloud service with multi-tenant model and logical access controls provides the best value and protection to confidential data of our customers such as translations, translation memory files, etc.<\/span><\/p>\n

Certifications<\/span><\/h3>\n

Phrase a.s. (formerly Memsource a.s.) has been<\/span> certified for ISO 27001<\/span><\/a> which proves that the information security management system (ISMS) which we have introduced conforms to the ISO standard. The ISO certificate was renewed for years 2020-2023.<\/span><\/p>\n

We use Amazon web services (AWS) as our cloud provider. AWS <\/span>is compliant<\/span><\/a> with a wide range of security standards including SOC 1\/ISAE 3402, SOC 2, SOC 3, FISMA, DIACAP, and FedRAMP, PCI DSS Level 1, ISO 9001, ISO 27001, ISO 27017, and ISO 27018.<\/span><\/p>\n

We use a third-party payment provider that is PCI DSS compliant and uses additional security mechanisms such as MasterCard SecureCode, Verified by VISA and SafeKey.<\/span><\/p>\n

Audits and Vulnerability Detection<\/span><\/h3>\n

Phrase services undergo third-party penetration tests each year. The tests are conducted in accordance with the OWASP ASVS standard.<\/span><\/p>\n

We operate a third-party hosted vulnerability disclosure program allowing independent researchers to responsibly disclose any vulnerabilities they may find in our applications and services.<\/span><\/p>\n

We use a third-party service for monthly automated vulnerability scans.<\/span><\/p>\n

Our information security management system is subject to annual internal audits and third-party audits verifying our compliance with the ISO 27001 standard.<\/span><\/p>\n

Data Control<\/span><\/h3>\n

The data in your Phrase account is protected. Only users who you have provided appropriate user rights to have access to your content. Instead of emailing data, users access data upon authentication in Phrase (see <\/span>Access Control<\/span><\/a>) and all user actions are logged.<\/span><\/p>\n

All stored data is encrypted using Linux LUKS (aes-xts-plain64:sha256) or AWS encryption (AES256).<\/span><\/p>\n

Data Centers and Locations<\/span><\/h3>\n

Phrase service is hosted on Amazon Web Services (AWS) platform. The physical servers are located in AWS data centers. User content can also be found in backups, stored in AWS S3.<\/span><\/p>\n

Production Environment<\/span><\/h3>\n

We maintain separate and distinct development, QA, pre-production and production environments.<\/span><\/p>\n

To access the Phrase production environment, authorized and trained members of the Phrase Engineering team members use VPN and authenticate using unique strong passwords and 2FA.<\/span><\/p>\n

Change Management<\/span><\/h3>\n

Phrase uses a formalized IT change management process designed to ensure that changes are authorized and operate as intended.<\/span><\/p>\n

The change management system in Phrase follows these principles:<\/span><\/p>\n