# 🔒 Flamingo Logic Hosted Services Security *Adam Sawtell | Last Updated: 2025-01-27* This document provides a high-level overview of Flamingo Logic's security measures to safeguard AbilityERP and your data against potential security vulnerabilities and threats. We prioritise application security and maintain close collaborations with trusted partners to continuously update and strengthen our protocols. --- ## 🛡️ Security Foundation ### Compliance & Standards - **Australian Privacy Act 1988**: Full compliance with Australian data protection regulations - **Australian Privacy Principles (APPs)**: Adherence to confidentiality, integrity, and availability standards - **Data Sovereignty**: All data is managed and stored within Australia, never leaving Australian borders - **AWS Best Practices**: Leveraging industry-leading security applications and protocols ### Infrastructure Security - **Australian AWS Services**: Utilising local AWS products with team expertise from internal growth and strategic partnerships - **Data Sovereignty**: All infrastructure and data processing occurs within Australian AWS regions - **Single-Tenant Architecture**: Each customer receives their own AbilityERP instance and database - **Data Isolation**: Complete separation of customer data, eliminating multi-tenant risks --- ## 🔧 Core Security Elements ### Server Management (AWS) - **Security Groups**: Virtual firewall controlling inbound/outbound traffic with protocol, port, and IP restrictions - **Network ACLs**: Additional firewall layer for subnets, working in conjunction with security groups - **VPC (Virtual Private Cloud)**: Isolated virtual networks protecting instances from public internet - **IAM (Identity and Access Management)**: Granular access control to AWS resources with specific permissions ### Encryption - **Storage Encryption**: All EC2 instance storage volumes encrypted - **Data in Transit**: Encrypted transmission of all data - **Data at Rest**: Encrypted storage where applicable - **Application-Level Encryption**: AbilityERP table-level encryption as required - **SSL/TLS**: All web-facing environments secured with SSL certificates ### Monitoring & Logging - **Amazon CloudWatch**: Real-time monitoring of AbilityERP instances - **AWS CloudTrail**: Comprehensive audit logs of user activity - **AWS Inspector**: Proactive security assessment service identifying vulnerabilities - **Continuous Monitoring**: 24/7 security event detection and response --- ## 🔐 Access & Authentication ### Multi-Factor Authentication - **Two-Factor Authentication**: Implemented across all core infrastructure accounts - **Single Sign-On (SSO)**: Centralised authentication for multiple applications - **Credential Management**: Secure credential storage and rotation ### Access Control - **Principle of Least Privilege**: Minimal access rights based on role requirements - **Role-Based Permissions**: Granular control over system access and actions - **Regular Access Reviews**: Ongoing assessment and adjustment of user permissions --- ## 🛠️ Operational Security ### Patching & Updates - **Regular Security Updates**: Latest patches applied to all applications and software - **iDempiere Community**: Direct access to security communications and vulnerability reports - **Proactive Response**: Immediate action on identified security issues ### Malware & Ransomware Protection - **Least Privilege Implementation**: Reduced attack surface through minimal permissions - **Security Groups**: Well-managed firewall rules and access controls - **Data Backup Strategy**: Multiple backup points for rapid recovery ### Backup & Recovery - **AWS EC2 Backups**: Daily backups retained for 7 days by default - **Immutable Storage**: External non-delete-able backup services - **Multiple Recovery Points**: Ability to rebuild from 3+ backup points - **Disaster Recovery**: Comprehensive recovery procedures and testing --- ## 👥 People & Process Security ### Team Security - **Security Training**: Regular education on data security best practices - **Security Culture**: Strong awareness and vigilance against potential risks - **Certified Professionals**: AWS-certified technicians ensuring best practices ### Audit & Assessment - **Regular Security Audits**: Internal and externally supported assessments - **Vulnerability Testing**: Proactive identification of security weaknesses - **Access Testing**: Verification of access controls and permissions - **Over-the-Shoulder Audits**: AWS professional support for protocol adherence ### Customer Support - **Implementation Security Review**: Assistance with internal security capabilities - **Legacy Integration**: Support for existing VPN and network security measures - **Custom Requirements**: Flexible implementation of additional security needs --- ## 📋 Additional Security Measures ### Data Protection - **Single-Tenant Benefits**: Reduced attack surface compared to multi-tenant systems - **Data Isolation**: Complete separation from other organisations' data - **Australian Data Sovereignty**: All customer data remains within Australian borders at all times - **Targeted Attack Reduction**: Smaller data footprint reduces targeted attack likelihood ### Confidentiality - **Non-Disclosure Agreements**: Available for detailed security discussions - **Sensitive Information Handling**: Secure protocols for confidential data sharing - **Transparency**: Willingness to provide detailed security information under appropriate agreements --- ## 🎯 Security Commitment At Flamingo Logic, we prioritise the security of AbilityERP by leveraging comprehensive AWS security elements. Our multi-layered approach includes: - **Network Security**: Security groups, ACLs, and VPC isolation - **Access Management**: IAM controls and least privilege principles - **Data Protection**: Encryption at rest, in transit, and application level - **Monitoring**: Continuous security assessment and vulnerability management - **Recovery**: Robust backup and disaster recovery procedures We remain committed to maintaining the highest standards of security to safeguard your AbilityERP system and ensure the trust and satisfaction of our customers. --- ## 🧠 Additional Notes - Security requirements are scoped during the implementation process - Regular security updates and improvements are part of our ongoing service - Detailed security information available under NDA as requested --- *For detailed security discussions or specific requirements, please contact our team to proceed with appropriate confidentiality agreements.*