Kongo manages a secure technology stack that is continuously monitored and patched to stay ahead of digital threats. Below is a summary of our policies and practices as it relates to compliance, privacy, and security.
Application Security
Traffic between integration customers and Kongo is protected with highly secure in-transit encryption using only the most secure TLS protocols and ciphers, along with 2048-bit encryption keys.
Kongo uses third-party Distributed Denial of Service (DDoS) protection software to ensure DDoS attacks are easily detected and thwarted before they cause a significant disruption to service.
Kongo’s integration platform codebase is continuously and automatically tested to ensure adherence to operational targets, including data integrity and security.
Application, audit, and system logs are captured and stored permanently, allowing for detailed research or troubleshooting.
Data Security
Customer data is encrypted in transit and at rest to ensure end-to-end protection with the latest standards and protocols.
Physical Servers, Data Center Security and Certifications
Kongo’s integration platform is powered by AWS data center management and security. Please visit the AWS website to learn more about AWS cloud security, or view all AWS compliance certifications.
Availability & Continuity
All infrastructure and Kongo integration platform components are redundant, with active failover mechanisms. Critical operational data is backed up automatically, and backups are regularly tested to ensure integrity and recoverability.
Data Encryption
Data in transit is encrypted with the most secure TLS versions and ciphers. We employ 2048-bit encryption at a minimum and rotate keys regularly. When connecting to third party services on behalf of customers (e.g., to synchronise data), we ensure all API endpoints are protected by a valid SSL certificate.
Data at rest is encrypted at multiple levels, including on the physical disk and by the logical storage subsystem using AES-256.
Operational Security
Vulnerability Detection
Kongo employs active vulnerability detection, which audits every action taken on our servers as well as all data ingress and egress. Suspicious activity is automatically flagged and sent to our security operations team for investigation. Our team regularly reviews audit logs, monitoring data access patterns by internal and external actors.
Malware Interception
Virus and malware protection with premium, self-updating tools ensures that our network remains free of malware, spyware, and other common Internet vulnerabilities.
Incident Response
Kongo maintains a detailed incident response plan to ensure that any security events and incidents are properly diagnosed, categorised, and managed.