Trust Center
Security
Access Management
Sylvan adheres to the principles of least privilege and role-based permissions when provisioning access; employees are only authorized to access data that they reasonably must handle in order to fulfill their current job responsibilities.
Sylvan employs multi-factor authentication for access to internal systems, including VPN requirements for engineers connecting to the application environment
Encryption
Sylvan encrypts data using industry standard protocols
Data in transit is encrypted using TLS 1.2 or higher
Data at rest is encrypted using AES-256.
Key management is in place for production services
Endpoint Security
All workstations issued to Sylvan personnel are configured by Sylvan to comply with our standards for security.
These standards require all workstations to be properly configured, updated, and tracked and monitored by Sylvan’s endpoint management solution.
Sylvan’s default configuration sets up workstations to encrypt data at rest, have strong passwords, and lock when idle.
Workstations run up-to-date monitoring software to report potential malware.
Network Security
Sylvan uses Google Cloud Platform for its infrastructure hosting, and makes use of Google Cloud Armor to protect against web attacks
System Monitoring and Alerting
Sylvan implements continuous monitoring of its infrastructure and application to ensure optimal availability. Issues are automatically identified and alerted to the appropriate team members, to ensure quick response and remediation.
Penetration Testing
Sylvan engages independent entities to conduct application-level and infrastructure-level penetration tests annually
Results of these tests are prioritized and remediated in a timely manner
Disaster Recovery and Business Continuity Plan
Sylvan utilizes services deployed by its hosting provider to distribute production operations across regions. These distributed areas protect Sylvans service from loss of connectivity, power infrastructure, and other common location-specific failures.
Sylvan performs daily backups and replication for its core database and supports restore capability to protect the availability of Sylvan’s service in the event of a site disaster affecting any of these locations.
Incident Response Plan
Sylvan has established policies and procedures for responding to potential security incidents.
All security incidents are managed by Sylvan’s dedicated Incident Response Team. The policies define the types of events that must be managed via the incident response process and classifies them based on severity.
In the event of an incident, affected customers will be informed in a timely manner. Incident response procedures are tested and updated at least annually.
Data Privacy
Data Sharing and Processing
Sylvan follows GDPR and CCPA guidelines to ensure data protection obligations to its customers. This includes only collecting, processing, and storing customer data in compliance with these obligations and providing customers the right to access or delete it at any time.
Data Retention and Disposal
Sylvan maintains a record retention schedule that complies with legal, regulatory, and operational requirements.
Sylvan performs safe and secure disposal of electronic and paper records, taking into consideration the confidential and sensitive nature of any customer data.
Third-party Vendor Management
Sylvan has established agreements that require sub processors to adhere to confidentiality commitments and take appropriate steps to ensure a proper security posture is maintained.
Sylvan monitors these sub processing vendors by conducting reviews of their controls before use and at least annually.
View our Data Processing Addendum here
Compliance
Sylvan prioritizes compliance efforts to ensure the requirements of customers and regulators are met. Sylvan maintains compliance with the following standards ISO 27001 GDPR CCPA HIPAA
IT Security Program
Sylvan utilizes enterprise-grade best practices to protect our customers’ data.
Continuous Security Control Monitoring
Sylvan uses Drata’s automation platform to continuously monitor 100+ internal security controls across the organization against the highest possible standards.
Automated alerts and evidence collection allows Sylvan to confidently prove its security and compliance posture any day of the year, while fostering a security-first mindset and culture of compliance across the organization.
Employee Trainings
Security is a company-wide endeavor. All employees complete an annual security training program and employ best practices when handling customer data.
Penetration Tests
Sylvan works with industry leading security firms to perform annual network and application layer penetration tests.
Secure Software Development
Sylvan utilizes a variety of manual and automatic data security and vulnerability checks throughout the software development lifecycle.
Data Encryption
Data is encrypted both in-transit using TLS and at rest.
Vulnerability Disclosure Program
If you believe you’ve discovered a bug in Sylvan’s security, please get in touch at hello@sylvanlabs.com Our security team promptly investigates all reported issues.
HIPAA
Sylvan utilizes enterprise-grade best practices to protect our customers' sensitive health information, and uses Drata to verify its security, privacy, and HIPAA compliance controls.
About HIPAA
HIPAA is a federal law that requires the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge.
Drata’s HIPAA product provides an automated approach to ensuring that organizations can demonstrate compliance.
Continuous Security Control Monitoring
Sylvan uses Drata’s automation platform to continuously monitor security controls across the organization. Automated alerts and evidence collection allows Sylvan to confidently prove its commitment to protecting your sensitive health information any day of the year, while fostering a security-first mindset and culture of compliance across the organization.
Employee Trainings
Security is a company-wide endeavor. All employees complete an annual HIPAA training program and employ best practices when handling customers' private health information.
Secure Software Development
Sylvan utilizes a variety of manual and automatic data security and vulnerability checks throughout the software development lifecycle.
Data Encryption
Data is encrypted both in-transit using TLS and at rest.
Vulnerability Disclosure Program
If you believe you’ve discovered a bug in Sylvan's security, please get in touch at hello@sylvanlabs.com. Our security team promptly investigates all reported issues.
