Security

At EclipseIQ, we understand the importance of maintaining the privacy and security of our clients’ data. Our clients trust us with their most sensitive information, and we take this responsibility seriously.

We maintain SOC 2 Type II compliance, demonstrating that our Information Security Program consistently meets rigorous industry standards for security, availability, integrity, confidentiality, and privacy.

It also reinforces our ongoing commitment to our clients who rely on secure handling of sensitive financial and operational data during due diligence processes.

Our comprehensive Information Security Program, which follows the criteria set forth by the SOC 2 Framework, is communicated throughout the organization.

‍Data Encryption

Policies: Our encryption policies are designed to comply with industry standards and regulations, ensuring that we meet or exceed the requirements for data protection and security.
In-Transit Encryption: All data in transit is encrypted using TLS 1.2 or higher.
At-Rest Encryption: All datastores housing sensitive client data are encrypted at rest using AES-256 or stronger encryption algorithms.

Data Confidentiality and Privacy

Architecture model: The EclipseIQ service uses a single tenant architecture model which ensures that each client’s data is isolated from another client.
Data Storage Locations: All data resides in the USA.
Retention: Client data is not used for training large language models (LLMs) and is subject to Zero Data Retention policies.

Authentication and Access Control

User Authentication: User accounts are protected by strong passwords that must meet specific complexity requirements. We require Multi-Factor Authentication (MFA) for all privileged access to production infrastructure.
Role-Based Access Control (RBAC): We follow the principle of least privilege with respect to identity and access management.
User Access Reviews: Administrators perform periodic reviews of user, administrator, and service accounts to verify that access is limited to systems required for their job functions.

Security Monitoring

Vulnerability Scanning: We perform continuous vulnerability scans to identify and remediate potential security weaknesses. The results are reviewed and addressed promptly to ensure that vulnerabilities are mitigated.
Logging and Monitoring: We generate and archive logs for systems and applications that store or allow access to sensitive data. These logs capture key security event types and are periodically reviewed to identify potential security incidents. Alerts are set to identify system failures, faults, or potential security incidents affecting client data.
Code Scanning: We use Static Application Security Testing (SAST) to identify vulnerabilities in our codebase before deployment. This automated tool scans the source code for security issues and ensures that any identified vulnerabilities are remediated prior to production release

Vulnerability Management

Regular Security Audits: Our team conducts thorough internal and external audits to verify compliance with our rigorous security policies and maintain the strength of our information security program.
Annual Penetration Testing: We engage independent third-party experts to perform penetration tests at least once a year. These tests challenge our defenses and ensure the continued integrity and resilience of our platform.
Continuous Improvement: Insights from our audits and tests drive ongoing enhancements to our security measures, keeping us ahead of emerging threats.

Employee Training

Vendor Management

Risk Assessment: Before engaging with any third-party vendor, DiligentIQ conducts a thorough risk assessment to identify potential risks associated with sharing confidential data or providing access to company systems.
Security Requirements: We establish and agree upon relevant information security requirements with each vendor. These requirements are documented in written agreements, which include the vendor's acknowledgment of their responsibilities for the confidentiality of company and customer data
Access Control: Access to our systems and data by third-party vendors is strictly controlled and limited to authorized personnel only.

Business Continuity and Disaster Recovery

Robust Planning: Our organization maintains a detailed Business Continuity and Disaster Recovery (BCDR) plan. This plan outlines strategies and procedures to maintain critical operations during unexpected disruptions and quickly restore full functionality if needed.
Regular Testing: We conduct annual tests of our BCDR plan to verify its effectiveness and identify areas for improvement. These tests simulate various scenarios to ensure we're prepared for a wide range of potential disruptions.

Incident Response

Structured Incident Response Plan: We maintain a formal, well-defined Incident Response plan tailored to address a wide range of potential information security events.
Rapid Detection: Our advanced monitoring systems and trained personnel work around the clock to quickly identify potential security incidents.
Coordinated Response: Upon detection, our dedicated incident response team follows established procedures to contain, investigate, and resolve security events efficiently
Timely Notification: We prioritize transparency and maintain clear communication protocols to keep affected parties informed throughout the incident lifecycle.