Understanding Regpack Security

https //www regpacks com/regpack security/ is a vital requirement for any registration system, but regpack goes above and beyond to make sure your applicants data is safe that said, questions will inevitably come from your applicants, so we created the faq below! if your question isn't answered here, please reach out to the support team at mailto\ support\@regpacks com your website is not https, how could it possibly be secure? often, applicants will mistake the security of your website for the security of regpack regpack provides you with an iframe code which you embed onto your website this provides applicants with a safe place on your website where they are able to enter in their important information, but it doesn't confer our security to the entirety of your website (see "man in the middle" for more) because of this, applicants will often look for the https designation in the url bar of your site, and if they do not see it, will become concerned (rightly) to address this concern, we'll provide you with a template site that demonstrates the security of our iframe to access it, make sure you are logged in and go to the project settings section under settings then on the embedding tab, you'll see your template link (feel free to add a logo) this let's skeptical applicants verify our security for themselves, but rest assured this security is the same security that is applied to the iframe embedded into your website! what if someone gets a "privileged network position" between the applicant and your registration site? a man in the middle attack looks like your applicant's computer > bad guy's computer > your registration website although this is not something regpack is not responsible for, it could happen if your site is not https a "man in the middle" attack demands extensive work especially when dealing with a system as complicated as regpack in order to do this, an attacker would need to completely copy the regpack system in terms of appearance and functionality (to trick your applicants into thinking they had arrived) in addition, this type of attack is correct for any link on your site and not only an embedded iframe if they have a link, a "man in the middle" can alter that link and send users to a totally different site that imitates the link they wanted to go to just to get a practical sense of how much of a threat this poses to your applicants, keep in mind that often banks don't have their front end marketing sites https certified that said, if this is something that concerns you, or your applicants are turned away by it, the resolution for this is turning your site into https with a certificate this can be done through a number of online vendors (godaddy, for example), and tends to cost a few hundred dollars on the low range again, technically a "man in the middle" attack is possible, but in order to pull it off the attacker will need to go through very extreme measures and will need to put in a lot of work imitating regpack is not easy! how are my payments secured? more technically, the regpack system functions on servers that are ssl 256 bit enabled all information is processed through the ssl protocol in order to ensure that the data transferred cannot be viewed by a non authorized third party the system has a split database mechanism where credit card information is not saved together with user information credit card details are saved on a pci 1 compliant server that is accessible only through a secure api that demands a username, password and is available only to a selected number of ip addresses therefore ensuring the credit card data can be accessed only within the regpack network together with the accessibility to our third party vendors the data is accessible only through the application itself thus ensuring that even if the database is compromised the credit card information is not this mechanism also supports the idea of “no human eye” where sensitive information cannot be accessed and understood without the use of inner algorithms created in the system these algorithms are created on the fly according to the specific situation at hand which acts as an additional layer of security regpack security details below is a summary of the security protocols that are in place to protect the information held within regpack’s digital architecture our servers are behind a physical firewall that is managed by a dedicated external security team it is configured on an "is allowed" basis meaning access is denied unless specifically approved regpack uses a split database mechanism in which key and values are separate from one another this mechanism creates a low level internal encryption of the data and masks the type of data being pushed across servers our servers are encrypted at the disk level all sensitive values in the databases are encrypted with a unique key per user this prevents the view/use the information unless the key, algorithm connected to the specific project, user, server, and time of encryption are all present the application automatically determines according to a set of variables which units are considered sensitive values regpack has the best in class waf (web application firewall) that filters all possible db attacks at the transmission level this prevents the ability to access the database through the application in addition, the system limits the amount of data that is transferred with every request and per ip to prevent the ability to access mass amounts of information regpack has regular code audits to make sure all code is written with security as a primary objective all of our code is done by an internal team our code review protocols prevents any release into production unless it passes all of our security guidelines regpack uses the services of rackspace managed security to perform hourly scans to all code, databases, and servers in addition to the automated scan, our servers are manually reviewed to confirm the integrity of all server elements on a daily basis penetration testing is performed on a weekly basis regpack is pci compliant level 2 and has passed all audits, since 2010, on the first scan our entire system is scanned on a weekly basis through a pci checking mechanism in addition, there is a monthly scan done by the pci compliance approval entity https //www regpacks com/regpack security/