Security self-assessment

AndonPulse is a Software Engineering Intelligence Platform. We help engineering leaders understand delivery performance, identify bottlenecks, and see where engineering investment goes—so they can make better decisions about priorities, resources, and improvements.

Link to this answer

Depending on the integrations and features used:

• Work records: Titles, descriptions, fields and historical activity.
• Development activity: Pull requests, commits, reviews and comments.
• Account and contributor information: Names, email addresses, usernames and identifiers.
• Workforce and cost information: Working schedules, time off and labor costs, where enabled.
• Integration credentials: Tokens and API keys for customer-authorized connections.

Further details are available on our data-processing page.

Link to this answer

AndonPulse connects to work-management, version-control and HR systems that your organization authorizes. You choose which systems to connect and the permissions granted to each connection.

Service providers help us deliver cloud hosting, content delivery and edge protection, billing, and monitoring. Our Subprocessors page lists these providers, the services they perform, the information they process and their processing locations. The Data Processing Agreement explains our obligations when engaging subprocessors and making changes to them.

Link to this answer

Yes. AndonPulse is hosted in the cloud on Amazon Web Services (AWS). Our core application infrastructure and customer databases are hosted in Northern Virginia, United States.

Customer analytics are stored in a separate database for each organization, while shared application records are separated through organization-scoped access controls. Stored customer information is encrypted, and automated database backups support recovery to a point within the preceding seven days.

AWS provides the physical security of the hosting facilities and baseline protection against distributed denial-of-service attacks. Cloudflare provides additional protection for traffic routed through its network.

Other service providers may process information in different locations. Our Subprocessors page identifies these providers, and our data-processing page explains information handling and locations in more detail.

Link to this answer

AndonPulse has not completed a SOC 2 audit and is not SOC 2 attested. We are not ISO 27001 certified. We do not currently have independent penetration-testing or security-assessment reports available.

For a company at our current size and stage, formal audits require a substantial investment. We currently prioritize practical security safeguards and documentation that customers can evaluate during their own security review.

Our approach includes:

• Customer data separation: Separate analytics databases for each customer, with organization-scoped access to shared application records.
• Access controls: Roles and permissions governing access to customer information, including sensitive financial data.
• Encryption in transit: Browser connections require TLS 1.3. External integration connections use TLS, with compatibility and supported protocol versions assessed separately for each integration.
• Encryption at rest: Customer databases and application-server storage use AES-256 encryption, with an additional layer of encryption for integration credentials.
• Security documentation: Published security practices, data-processing terms and subprocessor information, with supporting evidence shared on request.
• Account protection: We do not store account passwords in readable form, helping protect them if stored account information is exposed. Deactivating a user prevents further sign-in and ends their existing signed-in session.
• Customer-controlled connections: Authorized customers choose which systems to connect and can pause synchronization or disconnect integrations. Customers can also request changes to the information collected when they do not need the related metrics; we discuss the available options and their effect on insights.
• Security ownership and review: The Security team maintains our security practices. We review our security practices and documentation quarterly and after material changes, prioritizing improvements by customer exposure, recoverability and customer requirements.

We are happy to complete vendor security questionnaires, explain our practices, and provide relevant supporting evidence on request so customers can assess AndonPulse against their own security requirements.

Link to this answer

We have not completed an independent security audit, so no reporting period or audit report is available. Question 5 explains our security approach.

Link to this answer

Not applicable. AndonPulse has not completed an independent security audit. See question 5.

Link to this answer

Not applicable. AndonPulse has not completed an independent security audit. See question 5.

Link to this answer

Not applicable. AndonPulse has not completed an independent security audit. See question 5.

Link to this answer

Not applicable. AndonPulse has not completed an independent security audit. See question 5.

Link to this answer

No independent AndonPulse audit has been completed. Our operational providers are listed on our Subprocessors page; see question 3 for the distinction between integrations and service providers.

Link to this answer

AndonPulse manages security for its application and infrastructure. Customers are responsible for:

• Credentials: Protecting their account passwords and integration tokens.
• User access: Managing who can access their organization and removing access when appropriate.
• Connected systems and data: Authorizing integrations, managing permissions in connected systems, and having the necessary rights to provide information to AndonPulse.
• Their environment: Securing the devices, networks and systems they use to access or connect to AndonPulse.

Link to this answer

Customers sign in with individual email and password credentials. Multi-factor authentication can be discussed on request. Contact our Security team to arrange a review of your organization’s authentication requirements.

Organization administrators can manage user access and deactivate accounts when access is no longer required.

Link to this answer

Contact our Security team to discuss single sign-on for your organization, including your identity provider and SAML or OpenID Connect requirements.

Link to this answer

New or changed passwords must contain at least 15 characters. We do not require particular combinations of uppercase letters, numbers or symbols. These length and composition requirements follow NIST SP 800-63B-4 password guidance, which favors longer passwords over mandatory character combinations.

We do not store passwords in readable form, helping protect them if stored account information is exposed. Signed-in users must provide their current password before changing it. Password-reset links expire after six hours and can be used only once.

Existing passwords remain valid; the minimum length applies when a password is created or changed.

Link to this answer

You can view and update your account name and email address through account settings.

For information imported from connected systems, contact the administrator of the organization that connected those systems, or our Privacy team. That organization decides how its information is used, and we can help direct your request to it.

We assist authorized customers with privacy requests and their other obligations under the Data Processing Agreement. We handle individual requests under the Privacy Policy and applicable law. We may need to confirm your identity and authority to protect the information involved.

Link to this answer

We retain information for as long as needed to provide the service and fulfill the purposes described in our Privacy Policy and applicable agreements.

When paid service ends after cancellation, synchronization and use of integration credentials stop. We retain imported source records and derived analytics solely for customer reactivation for 90 days after paid service ends, then delete them unless reactivated. Earlier authorized deletion requests and DPA obligations take precedence. Cancellation does not automatically close organization or user accounts or delete integration credentials. Other retained records remain subject to the Terms, DPA, Privacy Policy and applicable law.

You can contact our Privacy team to request return or deletion. We confirm your authority and scope the request to the relevant information. On termination or expiry of the customer agreement, or an authorized written request, we delete or return personal information processed on the customer’s behalf under the DPA, unless retention is required by law. Account and organization records are included where the request and applicable obligations require it.

Encrypted backup copies may remain for up to 90 days under our Terms, isolated from further processing until deletion is possible. Our data-processing page explains how cancellation, disconnection and deletion requests differ.

Link to this answer

Our written security documentation includes:

• Security practices: Our Security page and this self-assessment explain our safeguards.
• Data handling and confidentiality: Our Privacy Policy, Data Processing Agreement and Terms of Service describe processing, confidentiality, retention and deletion responsibilities.
• Service providers: Our Subprocessors page identifies the providers involved in operating the service.

The Security team maintains our security documentation. We review our security practices and documentation quarterly and after material changes. Supporting evidence is available on request for customer security reviews.

Link to this answer

No. AndonPulse has not experienced any security incidents or data breaches.

Link to this answer

AndonPulse uses a multi-tenant architecture with logical separation between customer organizations:

• Application layer: Customer-data requests are scoped to the authenticated user’s organization. Authorization checks restrict access to that organization’s records.
• Storage layer: Each organization’s analytics data is stored in a separate customer database.
• Database layer: Shared application records include organization identifiers, and customer-facing queries are scoped to the relevant organization.

Customers access data within their own organization.

Link to this answer

Network segmentation is managed through multiple layers:

• AWS VPC: Application and database infrastructure operate within an AWS Virtual Private Cloud. Internal services communicate within the VPC and are not directly accessible from the internet.
• Security Groups: Inbound network rules limit access to the ports and protocols required for service operation.
• DDoS protection: AWS Shield Standard provides baseline protection against common network and transport-layer DDoS attacks. AWS documentation

Link to this answer

AndonPulse assesses third-party providers against these requirements:

• SOC 2 compliance: Subprocessors must have a SOC 2 audit report covering the relevant services.
• Data minimization: We limit information shared with each provider to what it needs to perform its service.
• Ongoing review: Providers are reassessed quarterly and after material changes. Providers that cease to satisfy our requirements are replaced.
• Subprocessor transparency: Providers processing customer data are identified on our Subprocessors page.

Link to this answer

Our vulnerability-management process includes:

• Security analysis: Automated checks identify weaknesses in application code, vulnerabilities in deployed software and accidentally exposed credentials.
• Development and release checks: Validation and relevant tests identify problems before release. Security findings are recorded with their severity, an owner and any agreed exception.
• Release qualification: Relevant tests and security checks are reviewed before deployment. Emergency exceptions have a recorded reason and follow-up review.
• Dependency review: Third-party software dependencies are checked for known vulnerabilities, with a weekly review of findings and required updates.

Report security concerns to our Security team.

Link to this answer

Encryption at rest: Customer databases and the storage used by our application servers use AES-256 encryption to protect stored information. Integration credentials have an additional layer of encryption to protect access to your connected systems.

Encryption in transit: Browser connections to AndonPulse require TLS 1.3 to protect information while it travels between you and the service. Connections to external integrations also use TLS; compatibility and supported protocol versions are assessed separately for each integration.

Credential protection: We do not store account passwords in readable form. Integration credentials are encrypted and used to make requests that your organization has authorized. Credentials for disabled synchronization are not used to retrieve information.

Link to this answer

• Source management: Source code is maintained under version control. Administrative access requires individual accounts, least privilege and multi-factor authentication.
• Review: Changes are reviewed before merge using a documented checklist.
• Automated checks: Relevant validation, automated tests and regression checks run before deployment.
• Release qualification: Changes pass the applicable testing and security checks before production deployment. Emergency exceptions require a recorded reason and follow-up review.
• Infrastructure changes: Infrastructure configuration is version-controlled so proposed changes can be reviewed and their effects traced.

Link to this answer

Security responsibilities include protecting customer information, using only authorized access and reporting security concerns. Security onboarding covers these responsibilities before employees or contractors receive production or customer-data access. Access controls and required administrative multi-factor authentication reinforce these requirements.

Link to this answer

Before employees or contractors receive production or customer-data access, we require proportionate identity and relevant reference checks.

Link to this answer

We combine network protections with application monitoring:

• DDoS protection: AWS Shield Standard supplies baseline protection against common network and transport-layer attacks; Cloudflare protects proxied traffic at the edge.
• Cloud networking: VPC boundaries and security groups restrict inbound access to application and database services.
• Application monitoring: Better Stack supports service monitoring and alerts routed to the Security team for investigation.
• Error monitoring: Application errors recorded through Better Stack are reviewed for failures and suspicious behavior.

Link to this answer

AndonPulse imports work records and engineering activity from customer-authorized systems. It does not operate a repository for customer software packages or provide antivirus scanning of imported comments and records. Infrastructure protections and application input validation address the service’s operating risks.

Link to this answer

• Least privilege: Production and customer-data access is limited to authorized personnel who need it; access is reviewed quarterly and after material changes.
• Administrative authentication: Multi-factor authentication is required for administrative access. It is enabled for our AWS, GitHub and Google Workspace accounts.
• Individual accounts: Each person uses their own account. Access is removed promptly when a person leaves or no longer needs it.
• Customer permissions: Organization-scoped roles govern customer access to records and actions.
• Provisioning: Organization administrators manage customer accounts and deactivate users. Contact our Security team to discuss automated account provisioning requirements.
• Account recovery: Password-reset links expire after six hours and can be used once. We do not store account passwords in readable form; see question 15 for the password policy.

Link to this answer

• Service monitoring: Better Stack monitors service availability and supports operational investigation.
• Application errors: Error reports help the Security team investigate failures, using sensitive-value filtering to limit unnecessary information in logs.
• Infrastructure records: Logs from enabled infrastructure sources support troubleshooting and security investigation.
• Alerts: Actionable service-health, error and security alerts are routed to the Security team, with delivery checks and a recorded handling process.

Log retention is documented for each configured source. Our ordinary operational-log retention target is 30 days within the existing service plan. Retention and sensitive-value filtering are checked as part of the operating review.

Link to this answer

AndonPulse runs on AWS and does not operate a data center. AWS controls physical access to its facilities and provides safeguards such as controlled access, surveillance, security personnel and environmental protection. Customers can review AWS’s description of data-center controls.

Link to this answer

• Stored data: Automated encrypted database backups allow us to restore application and customer analytics data to an earlier point within a seven-day recovery window. Before deliberately deleting a database, we preserve a final recovery copy with an assigned owner and deletion deadline.
• Database recovery: Isolated restoration tests verify that required data, configuration and decryption keys can be recovered, and record restoration time and results. Restored customer information follows our deletion procedure before it can return to service.
• Environment configuration: Version-controlled infrastructure and deployment configuration support rebuilding the service alongside restored data.

Core AWS hosting is in Northern Virginia, United States. Backup copies and final recovery copies follow the retention/deletion procedure and the existing upper limit of 90 days. See our data-processing explanation and Terms.

Link to this answer

• Initial response: The Security team triages and initially responds to security reports within 24 business hours. This is an initial-response commitment, not a resolution deadline or a staffed 24/7 service.
• Reporting: Contact our Security team, which is responsible for investigation, containment, recovery and follow-up.
• Customer communication: Affected customers receive incident updates. Personal-data breach notification follows our DPA obligation without undue delay.
• Availability updates: Service availability incidents are communicated through status.andonpulse.com.
• Incident history: AndonPulse has not experienced any security incidents or data breaches.

Link to this answer

Our core cloud infrastructure is defined in version-controlled configuration, providing a reviewable record of application servers, databases, storage and network resources. A complementary inventory tracks external services, their purpose, the information they handle, access and ownership.

The Security team maintains the inventory and reviews it quarterly and after material changes, so changes to systems, providers and responsibilities are reflected in our security records. Providers that process customer information are published on our Subprocessors page.

Link to this answer

• Source code is protected through individual administrative accounts, required multi-factor authentication and access limited to the permissions needed.
• Changes are reviewed before merge using a documented checklist, with relevant tests and security checks completed before deployment.
• Validation and automated checks identify problems during development.
• Relevant unit, integration and regression tests run before deployment.
• Release qualification includes applicable code analysis, testing and security checks. Checks for vulnerabilities in deployed software and accidentally exposed credentials supplement dependency checks; exceptions require an owner and recorded follow-up.
• Infrastructure configuration is version-controlled and reviewed before changes are applied.
• Our password policy explains account-password protection.
• Application input protections are checked at the relevant entry points and verified with representative inputs.
• Known dependency vulnerabilities are monitored, reviewed weekly and tracked for repair or a recorded exception.

Link to this answer

Our public guides are available at andonpulse.com/docs.

Link to this answer

You can find security information on our Security page and in our Trust Center.

Link to this answer

Service availability and incident updates are published at status.andonpulse.com.

Link to this answer

Our Subprocessors page identifies providers processing customer information. The Privacy Policy and Data Processing Agreement describe the applicable processing and assistance obligations.

Link to this answer

Privacy team — [email protected].

Our Privacy Policy and Data Processing Agreement explain how privacy requests are handled.

Link to this answer

Security team — [email protected].

Link to this answer

No. AndonPulse does not currently have cyber/security-liability insurance.

Link to this answer