Security / trust page — Blink

Cited by

Facts read from this source

• Security program frameworks Report an error

  “We’ve built a comprehensive security program that is in line with Cyber Essentials and National Cyber Security Centre (NCSC) Cloud Security Principles.”

• ISO 27001 Report an error

  “At Blink we are iso27001 compliant and certified. The data centres used for storing your content and allowing it to be delivered to your users are certified for compliance with the ISO 27001 standard.”

• Provider Report an error

  “Our infrastructure runs purely on Amazon Web Services (AWS), which delivers infrastructure as a service with prime security capabilities.”

• Encryption at rest Report an error

  “Your data is encrypted at rest in AWS S3 buckets, AWS RDS instances and block devices used by AWS EC2 instances. AES-256 encryption is used by default via AWS’ encryption services, while key management is handled by AWS KMS.”

• Password hashing Report an error

  “All user passwords are hashed using the Bcrypt password hashing function and stored in the database. Bcrypt uses salts and 10 rounds of an algorithm to increase the complexity of hashing”

• Encryption in transit Report an error

  “All communication between you, your services and Blink, that includes your data, traverses the Internet via encrypted HTTPS traffic using TLS.”

• Availability zones Report an error

  “Our infrastructure runs in Amazon Web Services, where all components are deployed in at least three availability zones, minimizing disruptions caused by any failure”

• Auto scaling Report an error

  “Our platform has been designed from scratch to support high volumes of web traffic and this technology stack is the fundamental piece that caters to our high availability needs. We utilise varies AWS tools to achieve this high level of availability.”

• Ddos protection Report an error

  “AWS provides volumetric denial of service protection through AWS Shield and Elastic Load Balancing to ensure high availability. Our security CDN performs application-layer denial of service protection alongside web application firewall protection.”

• Disaster recovery Report an error

  “Blink utilizes database replication architectures to ensure redundancy and uptime. Encrypted backups are made frequently and stored both onsite at the data centre and copied to a remote storage location.”

• Vulnerability management Report an error

  “Once a vulnerability is detected, it is assigned a score, using the CVSS scoring system, an owner and remediated according to our internal SLAs.”

• Code peer review Report an error

  “Our development process is based on GitHub's pull request mechanism. Once a commit is made to a branch in a specific repository, the code is reviewed by members of the same team or from other engineering teams.”

• Static code analysis Report an error

  “One such test is automatic static code analysis, configured to find vulnerabilities both in the code and within its dependencies.”

• Qa separation Report an error

  “Quality assurance is performed in a different AWS VPC that is configured with different domain names to ensure complete separation from production.”

• Secure sdlc Report an error

  “We implement the philosophy of "security by design" where security features are embedded in the product and architecture design”

• Incident response 24x7 Report an error

  “any event-alerting tools we use also escalate into PagerDuty rotations for Blink’s 24x7 incident response team.”

• Security training Report an error

  “Employees with developer and administrative roles also undergo secure code training annually”

• Mdm Report an error

  “All hardware devices (desktops, laptops, phones) issued to Blink employees come with encrypted storage partitions as well as MDM software”

• Security policies documents Report an error

  “Blink also has a public-facing privacy policy, as well as a security whitepaper and numerous security data sheets that are available on request from your Blink sales contact or account manager.”

• Stripe payments Report an error

  “Blink uses Stripe to process credit card payments, which means that no credit card information or related personal information is stored on our servers. Stripe enforces stringent PCI DSS (Payment Card Industry) compliance criteria”

• Password policy Report an error

  “we have an existing password policy in place based on NCSC guidelines. Passwords that are too generic are not allowed while the use of unique passwords per website is strongly advised. We also provide a password manager to all employees”

• SSO SAML Report an error

  “We provide Single Sign-On capabilities via SAMLv2. This means our customers have full control over who has access to the use of our product and how authentication takes place.”

• API key rotation Report an error

  “Your data is protected behind access tokens assigned individually to each user and follow the user's privileges. These keys are rotated hourly. Our application enforces authorization for every API call, apart from assets.”

• Vulnerability reporting Report an error

  “The best way to reach out to us is either via e-mail to support@joinblink.com or opening a ticket.”

• GDPR article33 Report an error

  “Blink will notify affected customers within undue delay following incident detection, where we share a preliminary assessment of the incident and are open to cooperation. We follow article 33 of the GDPR when personal data is involved, and alert the supervisory authority regarding breach of personal data.”

• Trust center Report an error

  “For the full picture of our certifications, policies, and controls, visit our Trust Center.”

• Responsibility accountability Report an error

  “Our Senior Management team is accountable for security and ensure that security capabilities and competence exist in all levels of our business.”

• Employee confidentiality Report an error

  “All Blink employees and contracted third parties are required to comply with Blink policies relevant to their scope of work, including security and data privacy policies. Our standard work contract includes confidentiality clauses.”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Data Protection Officer Integration, identity & administration
• The Data Protection Officer European sovereignty
• The Frontline Operations Lead Integration, identity & administration
• The Frontline Operations Lead European sovereignty
• The Internal Communications Lead Integration, identity & administration
• The Internal Communications Lead European sovereignty
• The Microsoft 365 Administrator Integration, identity & administration
• The Microsoft 365 Administrator European sovereignty
• The Skeptic Integration, identity & administration
• The Skeptic European sovereignty
• The Works Council Member Integration, identity & administration
• The Works Council Member European sovereignty