Confidentiality 

We place strict controls over our employees’ access to the data you and your users make  available via the MachShip services, as more specifically defined in your agreement with  MachShip covering the use of the MachShip services (“Customer Data”), and are  committed to ensuring that Customer Data is not seen by anyone who should not have  access to it. The operation of the MachShip services requires that some employees have  access to the systems which store and process Customer Data. For example, in order to  diagnose a problem you are having with the MachShip services, we may need to access  your Customer Data. These employees are prohibited from using these permissions to view  Customer Data unless it is necessary to do so. 

All of our employees and contract personnel are bound to our policies regarding Customer  Data and we treat these issues as matters of the highest importance within our company. 
‍

Personnel Practices 

MachShip employees receive privacy and security training during onboarding as well as on an  ongoing basis. All employees are required to read and sign our confidentiality policy covering  the security and confidentiality of the MachShip services. 
‍

Compliance 

The environment that hosts the MachShip services maintains multiple certifications for its data  Centres, including ISO 27001 compliance and PCI Certification. For more information about  their certification and compliance, please contact us.
‍

Security Features for Tenant Members & Administrators 

In addition to the work we do at the infrastructure level, we provide Tenant Administrators of  paid versions of the MachShip services with additional tools to enable their own users to  protect their Customer Data. 

Access Login 

Detailed access logs are available both to users and administrators of paid tenants. We log every  time an account signs in, noting the type of device used and the IP address of the connection. 

Tenant Administrators and owners of paid tenants can review consolidated access logs for their  whole tenant. We also make it easy for administrators to remotely terminate all connections and  sign out all devices authenticated to the MachShip services at any time, on-demand. 

Tenant-Wide Two-Factor Authentication 

Tenant Administrators can require all users to set up two-factor authentication on their  accounts. Instructions for doing this are available on our Help Centre. 

Deletion of Customer Data 

MachShip provides the option for workspace Primary Owners to delete Customer Data at any  time during a subscription term. Within 24 hours of workspace Primary Owner initiated deletion,  MachShip hard deletes all information from currently-running production systems (excluding  tenant names, and search terms embedded in URLs in web server access logs). MachShip  services backups are destroyed within 90 days.* 

Return of Customer Data 

Information about the export capabilities of the MachShip services can be requested by email. 
‍

Data Encryption In Transit and At Rest 

The MachShip services support the latest recommended secure cipher suites and protocols to  encrypt all traffic in transit. Customer Data is encrypted at rest. 

We monitor the changing cryptographic landscape closely and work promptly to upgrade the  service to respond to new cryptographic weaknesses as they are discovered and implement  best practices as they evolve. For encryption in transit, we do this while also balancing the  need for compatibility for older clients.
‍

Availability 

We understand that you rely on the MachShip services to work. While we don’t warrant,  represent or guarantee that MachShip will be entirely fault free or that it will be available  100% of the time, we’re committed to making MachShip a highly-available service that you  can count on. Our infrastructure runs on systems that are fault tolerant, for failures of  individual servers or even entire data Centres. Our operations team tests disaster-recovery  measures regularly and staffs an around-the-clock on-call team to quickly resolve unexpected  incidents. 
‍

Disaster Recovery 

Customer Data is stored redundantly at multiple locations in our hosting provider’s data  Centres to ensure availability. We have well-tested backup and restoration procedures,  which allow recovery from a major disaster. Customer Data and our source code are  automatically backed up nightly. The Operations team is alerted in case of a failure with this  system. Backups are fully tested at least every 90 days to confirm that our processes and  tools work as expected. 
‍

Logging 

MachShip maintains an extensive, centralised logging environment in its production environment which contains information pertaining to security, monitoring, availability, access,  and other metrics about the MachShip services. These logs are analysed for security events  via automated monitoring software, overseen by the security team. 
‍

Incident Management & Response 

In the event of a security breach, MachShip will promptly notify you of any unauthorised  access to your Customer Data. MachShip has incident management policies and procedures in place to handle such an event. 
‍

Product Security Practices 

New features, functionality, and design changes go through a security review process  facilitated by the security team. In addition, our code is audited with automated static  analysis software, tested, and manually peer-reviewed prior to being deployed to  production. The security team works closely with development teams to resolve any  additional security concerns that may arise during development. 

*MachShip services backups are destroyed within 90 days, except that during an on-going  investigation of an incident such period may be temporarily extended.
‍

Contacting MachShip 

Please also feel free to contact us if you have any questions about MachShip’s Security  Practices Policy. You may contact us at support@machship.com or at our mailing address  below: 

MachShip 

c/- MachShip Australia PTY LTD  

115 Cremorne Street 

Cremorne, VIC 3121 

Australia