Security at Doozy

At Doozy we value your security and privacy, ensuring we follow industry best practices to keep your data safe and secure.

If you have any questions about how Doozy is built, our processes or how we handle data, please get in touch with us at [email protected].

SOC 2 Type II Compliance

Doozy has completed a SOC 2 Type II certification.

Achieving SOC 2 compliance signifies that Doozy has established the necessary procedures, policies, and controls to meet the AICPA's trust services criteria for security, availability, and confidentiality. Furthermore, these processes and controls have been tested to verify their effective operation.

Get in touch with us at [email protected] to request a copy of our report.

How Doozy protects your data

Pseudonymization and encryption of personal data

Customer data is encrypted at rest with 256-bit AES.

Secure tokens for Slack, Merge and Google Calendar are further encrypted with AES-128 and rotated monthly.

Ensuring ongoing confidentiality, integrity, availability, and resilience of processing systems and services

Doozy runs on Google Cloud Infrastructure, which offers a Service Level Agreement (SLA) that guarantees a certain level of uptime and availability for services, including Firestore (with a guaranteed uptime of ≥ 99.99%) and Storage (with a guaranteed availability of ≥ 99.9%).

Data is encrypted in transit using HTTPS (≥ TLS 1.2).

We conduct monthly vulnerability scans to ensure systems are configured correctly and are up to date.

Ability to restore the availability of and access to the Customer Personal Data in a timely manner following a physical or technical incident

Daily, weekly and point-in-time backups are encrypted and stored in multiple regions for redundancy.

Our customers have access to support through Slack Connect, with a standard SLA response time of under 12 hours, usually much quicker!

Regular testing, assessment, and evaluation of the effectiveness of technical and organizational measures used to secure Processing

Monthly scans are conducted to check for network vulnerabilities. Automated testing is run automatically for all code deploys.

User identification and authorization process and protection

Strong security measures are enforced, including password complexity and MFA to ensure access to production systems is secure.

Role-based access control is in place through groups and IAM to ensure access to data is on a strictly need-to-know basis.

Access to production data is time-limited and requires exec approval, and it is fully audited.

Protecting Customer Personal Data during transmission (in transit)

All communications are encrypted in transit over HTTPS.

Protecting Customer Personal Data during storage (at rest)

Customer data is encrypted at rest with 256-bit AES.

Physical security where Customer Personal Data is processed

Customer data is stored securely within the Google data centers, and protected 24/7 by their industry-leading security team.

Security measures include perimeter defense systems, comprehensive camera coverage, biometric authentication, and a 24/7 guard staff. Learn more here.

Events logging

Audit logs are enabled and configured for all production environments using GCP Cloud Audit Logging.

Access to production data requires C-Level approval and is time limited.

Detailed application logs are produced to track user activities, errors, exceptions and security events. On-call engineers are automatically notified of customer and security impacting issues.

Systems configuration, including default configuration

Infrastructure is running fully serverless in Google Cloud and Vercel, and security patches and updates are automatically applied.

Firebase infrastructure configuration is managed through code and reviewed via pull requests.

Internal IT and IT security governance and management

Devices are managed through an MDM, and strict policies are in place to ensure that the best security standards are being upheld by staff such as device locking, secure password policies and MFA.

Access to production systems is heavily monitored and access time-limited and audited on a need-to-know basis.

Certification or assurance of processes and products

Doozy are SOC2 Type II compliant and can provide and audit report on request.

Our infrastructure runs on Google Cloud, which maintains a wide range of industry certifications, including ISO 27001, SOC 2, and others, which reflect its commitment to security and compliance. These certifications extend to the infrastructure services used.

Ensuring data minimization:

Doozy follows a strict data collection and processing policy. We collect and retain only the data necessary for specific, well-defined purposes.

We regularly review and minimize the data we hold, ensuring its relevance and accuracy. Access to this data is tightly controlled, and data subjects' rights, including the right to access and erasure, are respected.

Ensuring data quality

Data is kept up to date through periodic and real-time syncs between external systems such as Merge, Slack, and Google Calendar.

Thorough unit and integration testing is in place to ensure these systems are communicating and storing data correctly.

Ensuring limited data retention

Doozy only retains data for as long as needed to fulfill contractual and regulatory requirements. Once that is no longer the case, data is deleted within 30 days.

Regular data audits are performed to ensure data is not being stored for longer than necessary.

Ensuring accountability

We maintain accountability by assigning clear roles and responsibilities for data protection, conducting regular audits, and adhering to data protection regulations.

Allowing data portability and erasure

Customers can request an export of their data which will be provided in a machine-readable format (JSON) made available to them securely within 30 days of request.

Data erasure requests are honored within 10 days, ensuring data is securely deleted in compliance with GDPR.

Secure Infrastructure

Google Cloud

We utilise Google Cloud for our primary backend infrastructure.

Your data is stored in Firestore and automatically encrypted using 256-bit advanced encryption. Learn more

Google Cloud is SOC 2 and ISO 27001 certified. You can learn more about Google Cloud compliance here.

Vercel

Our front-end app is hosted on Vercel and all requests are secured with industry standard encryption.

Vercel is SOC2 and GDPR compliant.

Learn more about security at Vercel here

Daily.co

We use Daily.co to provide the Video + Audio features with Doozy. Daily.co are an industry leader using the latest best practices in Security. All calls are encrypted and no audio or video data is stored on ours or Daily.Co's servers.

Daily.co are SOC2 and GDPR compliant.

You can learn more about Daily.co and their security practices in their Security Centre

Merge

We partner with Merge to provide HRIS integrations.

Merge are SOC2 and GDPR compliant.

You can learn more about Merge and their security practices in their Security Centre

Operational security

We have a number of policies in place to ensure our systems stay secure including:

• Requiring 2FA to access production systems and we operate on the principle of least privilege. Access to our core systems is audited and reviewed regularly.
• All code changes must be reviewed and tested before being deployed.
• All data is encrypted at rest and in transit.
• Slack, Calendar and HRIS tokens are further encrypted.
• Dependencies are regularly updated and we use Dependabot and Snyk to alert us of vulnerabilities.
• We run on serverless infrastructure, with security patches applied automatically by Google and Vercel.

Reach out to our team to request a completed Vendor Security Alliance (VSA) questionnaire.

PCI Obligations

All payments are made through Stripe. Details about their security setup and PCI compliance can be found at Stripe's security page.

If you have any questions, get in touch with the team at [email protected]

We can provide a completed Vendor Security Alliance (VSA) questionnaire on request. Please email [email protected] for more information.