Security Architecture

The Exponea Application is provided through the Google Cloud Platform (GCP). We will explain below how we ensure our security and the safety of your customer data.

Within Exponea we utilize several security layers to ensure the integrity of our application. These layers include the environment that Exponea functions within and the various offerings of our platform.

Security Overview

The following visualization illustrates the differences between the three instances. The upper portion details how data in transit is secured and encrypted before entering Exponea, while the lower part shows a high-level overview of Exponea architecture and security features for each instance.

Encryption

Whenever we store data there are several layers of encryption. By default, data is encrypted both at rest and in transit.

Encryption at rest protects your data from a system compromise or data exfiltration by encrypting data while stored. To encrypt data at rest, the Advanced Encryption Standard (AES) is used. Our encryption utilizes encryption keys, which are managed by Google (see Encryption at Rest in Google Cloud Platform).

Encryption in transit protects your data if communications are intercepted while data moves between your site and the cloud provider. This protection is achieved by encrypting the data before transmission, authenticating the endpoints and decrypting and verifying the data on arrival. This level of security is achieved through Transport Layer Security (TLS) to encrypt data in transit. TLS acts as a tunnel to separate data from the outside environment, and the endpoints are exchange encryption keys. GCP also encrypts and authenticates all our data in transit at one or more network layers, when data moves outside physical boundaries not controlled by or on behalf of Google. Furthermore, Data in transit inside a physical boundary controlled by or on behalf of Google is generally authenticated but not necessarily encrypted. Our encryption utilizes encryption keys, which are managed by Google (see Encryption in Transit in Google Cloud Platform).

Redundant Architecture

GCP runs in a multi-tenant, geographically distributed environment to support the availability of services. It is guaranteed by GCP that data is distributed amongst a shared infrastructure, designed to store extremely large amounts of data across many servers.

We also have built a highly-available, resilient and redundant architecture to ensure that our data is replicated in real-time, to multiple zones and data centers at any time. This provides high availability for our clients by dynamic load balancing across those sites.

Instances

Exponea offers three main types of instances: shared, private and exclusive instance. These each contain different features and configuration of data layers which we will explain below. In each of these instances, data is separated and access management is enabled to ensure your security.

Shared instance

Our shared instance is for SMEs who are not subject to the strictest regulation.

Within our shared instance, users cannot access data from other clients and data in separated on a frontend level. Resources are also shared on a backend level.

Shared instances are encrypted at the level of GCP infrastructure and undergo periodic security scans and pen tests.

To access the account on the shared instance, users must choose a strong password and may use two-factor authentication (2FA) to sign in. The accounts are further secured by captcha to fence off bot attacks. The admin of the particular project can also specify in the Access management which users can see PII (personally identifiable information) of their customers. This segregation is on the frontend and backend.

The features included in our shared instance are:
Password guardian
Captcha
Identity Access Management (IAM)
DDoS protection
Firewall
Data Encryption (SSL/TLS and AES)
Static IPs
SSH Tunnel
Vulnerability Scanning operational
Audit logs operational: Application, Infrastructure, and IAM

The shared instance is like a building with multiple offices, each with a security door. As all clients share a single Google Cloud Platform, but they all have different accounts each with a separate password, data segregation exists between the multiple instances.

Private Instance

Our private instance is for multinational brands that require a higher level of data security and may face tougher data scrutiny.

Within our private instance, data layers are logically separated on the backend. The computing resources reserved for the client are separated from other resources on the backend by namespace.

Private instances are encrypted at the level of GCP infrastructure and undergo periodic security scans and pen tests.

To access the account on the private instance, users must choose a strong password and may use two-factor authentication (2FA) to sign in. The accounts are further secured by captcha to fence off bot attacks. The admin of the particular project can also specify in the Access management which users can see PII (personally identifiable information) of their customers. This segregation is on the frontend and backend.

Private instance features include:
Password guardian
Captcha
Identity Access Management (IAM)
DDoS protection
Firewall
Data Encryption (SSL/TLS and AES)
Static IPs
SSH Tunnel
Vulnerability Scanning operational
Audit logs operational: Application, Infrastructure, and IAM
Additional security features:
Exponea SSO (SAML2)
IP restriction (Cloud Armor)
Virtual Private Network (VPN)
Vulnerability scan report with access
Audit log report access: IAM and Application

Private instances are like separate buildings of their own which only share electricity supply. Each instance is managed within a separate capacity while being powered by GCP.

Exclusive Instance

Our exclusive instance is designed for large companies who have strict regulatory obligations to meet, as they handle sensitive categories of data.

Exclusive instances are encrypted at the level of GCP infrastructure and undergo periodic security scans and pen tests.

To access the account, the Exclusive instance also supports Single SIgn-On (SSO) to meet security standards in this industry. The accounts are further secured by captcha to fence off bot attacks. The admin of the particular project can also specify in the Access management which users can see PII (personally identifiable information) of their customers. This segregation is on the frontend and backend.

This platform includes complete segregation of logical layers and network separation through utilizing a different GCP project and backend computing resources dedicated to you Within the exclusive instance there is also the separation of access rights and permissions.

The Exclusive instance allows:

  • the client to administer their logs, through streaming to their SIEM
  • an ‘emergency break’ option, which gives the client the option to cut-off Exponea from production
  • switching on new Google services / network / access rights to the backend architecture
The exclusive instance includes the following features:
Password guardian
Captcha
Identity Access Management (IAM)
DDoS protection
Firewall
Data Encryption (SSL/TLS and AES)
Static IPs
SSH Tunnel
Vulnerability Scanning operational
Additional security features:
Exponea SSO (SAML2)
IP restriction (Cloud Armor)
Virtual Private Network (VPN)
Vulnerability scan report access
Audit log report access: Infrastructure, IAM and Application
Separation layersSharedPrivateExclusive
Data layerYour data visible only in your accounts / projectsYour data visible only in your accounts / projectsYour data visible only in your accounts / projects
Users layerUsers authorized only for your accounts / projectsUsers authorized only for your accounts / projectsUsers authorized only for your accounts / projects
Frontend layerApplication settings, definitions, campaigns visible only within your projectsApplication settings, definitions, campaigns visible only within your projectsApplication settings, definitions, campaigns visible only within your projects
Backend layerShared network, shared databases, shared Kubernetes clusterLogically separated network and all backend services, shared and dedicated databases, shared Kubernetes clusterNetwork separated from scratch, dedicated databases, dedicated Kubernetes cluster
Infrastructure administrator accessShared administrator accessesShared administrator accessesAdministrator accesses established from scratch

Updated about a month ago


Security Architecture


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.


We rely on cookies

to optimize our communication and to enhance your customer experience. By clicking on the Accept and Close button, you agree to the collection of cookies. You can also adjust your preferences by clicking on Manage Preferences. For more information please see our Privacy policy.

Manage cookies
Accept & close

Cookies preferences

Accept & close
Back