Humanloop – Security Policy

Humanloop is committed to securing data, eliminating system vulnerabilities, and ensuring continuity of access. Humanloop uses industry-leading technologies and services to secure data from unauthorised access and loss.

Security processes and controls are owned by Humanloop’s Chief Technology Officer and are maintained by the engineering & operations teams.

All Humanloop employees undergo background checks before starting and are trained on security practices during company onboarding and on an annual basis.

Services covered

This document summarises the security controls applicable to the Humanloop platform, which is made up of the web application (https://app.humanloop.com/), the API and the SDKs. This represents the total surface area of the platform. More detailed documentation describing the platform can be found here.

As part of Humanloop’s security program, other related documents are:

Infrastructure

Humanloop is a cloud first platform and leverages Amazon Web Services (AWS) as the chosen cloud provider for production workloads:

Humanloop inherits the data center controls as outlined by AWS. Information about security audits received by AWS is available from the AWS security website.
A single instance of the Humanloop platform is provisioned in a single environment that is fully contained within its own secure virtual private cloud (VPC) with a firewall configuration that adopts the position of least privilege.
The production environment is located within multiple availability zones within the US East region.
Humanloop is the assigned administrator of the AWS infrastructure and only designated authorised Humanloop team members have access to change infrastructure configuration on a least privilege, as needed basis. Two-factor authentication within the virtual private network is required.
Any specific private keys required by the platform are stored in a secure and encrypted location.

Data controls

Segregation

Separate environments are provisioned and maintained for the purposes of development, quality assurance/user acceptance testing and production, to ensure data segregation at the environment level.

Each environment contains a multi-tenant architecture that provides effective logical data separation for different clients via specific organization and team identifiers, with a roles-based-access control application layer.

Classification

All platform data received from the user and data derived from user data is classified as sensitive. All platform audit and telemetry data that does not contain PII and reference to specific user data is classified as not sensitive.

By default, only authenticated users can see their own sensitive data and data classified as not sensitive can be accessed by dedicated Humanloop support staff using a secure VPN connection to the private network of the VPC for the target environment. The purpose of this access is to debug issues and help improve the performance of the system. The Terms of Service define further details around data ownership and access on a case by case basis.

Encryption

Best practices around encryption are followed. All data in transit is be secured with TSL/SSL and all data at rest is encrypted using the AES-256 algorithm. All encryption keys are managed using AWS Key Management Service (KMS) as part of the VPC definition.

Storage, retention and backups

All platform data is stored in a primary database server with multi-availability zone replication. Platform data is retained indefinitely and backed up daily in a secure and encrypted manner until a request is made from the contractual owners of that data to remove it and in accordance to GDPR guidelines. Humanloop’s Terms of Service defines the contractual owner of the user data and data derived from the user data. A semi-automated disaster recovery process is in place to restore the database to a specified point in time backup as and when required.

Data breaches

Any data breaches will be communicated to all impacted Humanloop users and partners within 24 hours, along with consequences and mitigations. Breaches will be dealt with in accordance with the Humanloop data breach response policy, which is tested annually.

Return of user data

Within 30 days post contract termination, users can request return of their data and derived data (as defined by the Terms of Service). Humanloop provides this data via downloadable files in comma separated value (.csv) or .json formats.

User authentication

All users of the web application require a valid email address and password to use the system:

Email addresses are verified on account creation.
Passwords are verified as sufficiently complex.
Passwords are stored using a one-way salted hash.
User access logs are maintained including date, time, user ID, relevant URL, operation performed and source IP address for audit purposes.

All users of the API are required to authenticate with a unique API token header:

Follows the OAuth 2.0 pattern.
API tokens are only visible once on creation and then obfuscated.
Users can manage the expiry of API keys.
API token access logs are maintained including date, time, user ID, relevant URL, operation performed and source IP address for audit purposes.

Third party services

The Humanloop platform makes use of third party services primarily for hosting and analytics which are detailed further in the List of Subprocessors.

Audits and certifications

Humanloop is regularly penetration tested (3 times a year) by an external CREST approved penetration test provider to minimise the risk of platform vulnerabilities that would breach controls. For testing, Humanloop provides the agency with an isolated clone of a Humanloop environment with documentation. No user data is exposed during this process.
Humanloop runs continuous security scanning on all externally facing resources as well as automatic dependency vulnerability checking on source code.
Humanloop is currently in the process of attaining SOC-2 compliance status, with estimated time of completion for SOC-2 Type 1 at the end of Q2 2023 and SOC-2 Type 2 at the end of Q3 2023 (with the option to expedite if necessary).

Training

All new employees receive onboarding and systems training. This includes environment and permissions setup, security policies review and values and ethics training. All policies that are provided to employees are reviewed once a year to ensure they kept up to date.

Application development lifecycle

Humanloop has continuous integration and deployment - all code changes are committed, tested and deployed in an automated fashion. Our continuous deployment process includes a pull request review process, continuous integration with automated testing and automated security vulnerability checks. This process decreases the likelihood of security issues and improves the SLA for resolving any vulnerabilities found.

All engineering resources operate in accordance with OWASP guidelines when prioritising security related issues, with high priority security related issues resolved immediately. Release notes for Humanloop are provided by the public changelog.

Policies maintained

In general the types of controls in place for the platform are:

Physical access controls
System access controls
Data access controls
Transmission controls

Humanloop maintains the following internal security policies that detail the controls:

Information security policy
Information security roles and responsibilities
Asset management policy
Access control policy
Data management policy
Operations security policy
Human resources security policy
Physical security policy
Risk management policy
Third-party management policy
Cryptography policy
Business continuity and disaster recovery plan
Incident response plan
Secure development policy

Last updated: 12 May 2023