Data Security Policy

Document Last Modified: January 9, 2025

Commitment to Security, Availability, and Privacy

Thousands of users depend on Capstone Planning every day to keep their information safe while managing critical business processes. Capstone Planning prioritizes security, privacy, and availability by utilizing advanced technology, a skilled and experienced staff, strict adherence to industry standards, and flexibility to meet diverse client needs.

Security

Capstone Planning leverages multiple layers of defense to protect key information, including authentication, authorization, and assurance. Our security program follows industry best practices, combining stringent, risk-adjusted security controls across physical, network, system, and application layers.

Secure Data Centers

Capstone Planning partners with certified data center providers adhering to rigorous standards such as HIPAA, ISO 27001, NIST 800-53, PCI DSS, SOC 1 Type II, and SOC 2 Type II to ensure optimal security.

Encryption

We offer strong encryption options to secure data in transit and at rest, protecting information transmitted over untrusted networks.

Cloud Infrastructure

Capstone Planning's cloud infrastructure adheres to best practice guidelines to ensure maximum reliability and security.

Security Monitoring

Our networks and systems are continuously monitored using advanced Security Information and Event Management (SIEM) tools, correlating events for evaluation by our security team.

Strict Access Controls

Access to Capstone Planning systems is highly restricted. Internal audits and automated tools verify configurations to maintain desired security levels. All administrative access is limited to essential personnel and logged securely.

Data Security

Capstone Planning employs robust encryption for data transit and storage, including offsite backups. Access to client data is restricted, and support personnel undergo specialized security training before handling sensitive information.

Incident Response

Capstone Planning has an incident response process in place to handle client data incidents promptly and effectively.

Training

All employees participate in comprehensive security training to maintain a high level of awareness and expertise.

Software Engineering Security Process

Security is a key focus throughout the product lifecycle. New features undergo rigorous security audits, and application-wide assessments are performed regularly. Third-party components are carefully monitored for vulnerabilities.

Certified Security Personnel

Capstone Planning's security team includes experts with extensive industry experience and advanced certifications, ensuring policies and controls meet the highest standards.

Best Practices

Capstone Planning follows OWASP-compliant secure programming guidelines, regularly updated to reflect evolving threats. Best practices cover data sanitation, authentication, authorization, and resource usage.

Tools

Our security environment is monitored with industry-leading tools such as Intrusion Detection Systems (IDS), Distributed Denial of Service (DDoS) mitigation, Web Application Firewalls (WAF), and advanced application security scanning solutions.

Privacy

Capstone Planning is committed to protecting client data. Client data is never accessed without explicit permission and is never shared with third parties. We uphold strict confidentiality and make no compromises in safeguarding the privacy of our clients.