Security & Compliance

Our Commitment to Security & Compliance

At RansomLeak, we understand that trust is earned through transparency and action. Your organization's security awareness training data is valuable and sensitive, and we take our responsibility to protect it seriously.

Our security infrastructure is built on AWS with industry best practices, including encryption at rest and in transit, multi-tenant isolation, network segmentation, least-privilege access controls, and continuous monitoring.

Compliance & Certifications

RansomLeak maintains compliance with industry-leading security frameworks and regulatory requirements.

NIST Framework

Aligned with NIST Cybersecurity Framework controls across identify, protect, detect, respond, and recover functions.

DORA

Supports EU Digital Operational Resilience Act requirements for operational resilience and ICT risk management.

NIS2 Directive

Implements security measures aligned with EU Network and Information Security Directive for essential services.

CSA STAR Level 1

Cloud Security Alliance STAR certification demonstrating cloud security best practices and transparency.

WCAG 2.1 Level AA

Meets Web Content Accessibility Guidelines ensuring the platform is accessible to users with disabilities.

GDPR Compliant

Implements technical and organizational measures required by EU General Data Protection Regulation for data privacy.

CCPA Compliant

Supports California Consumer Privacy Act requirements including data access, deletion, and portability rights.

AWS Security Best Practices

Built on AWS infrastructure following Well-Architected Framework and inheriting AWS certifications including SOC 2 and ISO 27001.

Infrastructure Compliance Features

• Encryption: AES-256 encryption at rest, TLS 1.3 encryption in transit, with key management through AWS KMS
• Access Controls: Role-based access control (RBAC), multi-factor authentication (MFA), least-privilege IAM policies
• Regular Audits: Internal security audits, third-party security assessments, vulnerability scanning, and penetration testing
• AWS Compliance: Built on AWS infrastructure certified for SOC 2, ISO 27001, FedRAMP, and other standards

Data Encryption

We employ comprehensive encryption to protect your data at every stage:

• Encryption at Rest: All stored data is encrypted using AES-256 encryption, including your database (RDS PostgreSQL), file storage (Amazon S3), and application secrets
• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3 with HTTPS enforcement
• Key Management: Encryption keys are managed securely through AWS Key Management Service (KMS) with automatic rotation

Multi-Tenant Data Isolation

Enterprise-grade data separation ensures complete isolation between organizations:

• Schema-Based Separation: Each organization's data is logically isolated using dedicated database schemas
• Query-Level Filtering: All database queries include mandatory tenant identification
• Access Control Validation: Application-level security controls prevent cross-tenant data access
• Audit Trail: All data access is logged with tenant context for complete visibility

Network Security Architecture

Our infrastructure is designed with defense-in-depth principles and multiple security layers:

• Private Subnet Isolation: All application servers, databases, and caching layers operate within private subnets with no direct internet access
• Network Segmentation: Amazon VPC creates isolated network environments across multiple availability zones
• Firewall Configuration: Security groups act as stateful firewalls with least-privilege network access
• DDoS Protection: AWS Shield Standard provides automatic protection against common DDoS attacks

Access Controls & Identity Management

We implement comprehensive access controls to ensure that only authorized personnel and systems can access your data:

• Least-Privilege Principle: All system components and users operate with the minimum permissions necessary
• Role-Based Access Control (RBAC): User permissions are assigned based on roles and responsibilities
• Multi-Factor Authentication (MFA): MFA is enforced for administrative access to our AWS infrastructure
• Temporary Credentials: Infrastructure access credentials are temporary and rotate automatically every 6-12 hours

Monitoring & Auditing

Continuous monitoring and comprehensive auditing help us detect and respond to security events:

• SIEM: We implement SIEM practices for aggregating, analyzing, and correlating security events
• Continuous Security Monitoring: Our systems continuously monitor for security anomalies and suspicious activities
• Application Logging: All application activities are logged to Amazon CloudWatch Logs
• API Auditing: AWS CloudTrail logs all API calls for an immutable record of administrative actions

Incident Response

We maintain clear procedures for responding to security incidents:

• Breach Notification: We will notify affected parties within 72 hours of becoming aware of any personal data breach (GDPR Article 33)
• Incident Detection: Our monitoring systems continuously watch for security anomalies and potential threats
• Response Procedures: We maintain documented incident response procedures for consistent, effective handling

Security Contact: For security concerns or to report a vulnerability, please contact us at security@ransomleak.com.

Secure Development Lifecycle (SDLC)

Security is integrated into every phase of our software development process:

• Secure SDLC Practices: Security considerations from initial design through deployment and maintenance
• Code Reviews: Every code change undergoes peer review before being merged
• Static Code Analysis: Automated SAST tools scan code for security vulnerabilities
• Dependency Scanning: All third-party dependencies are automatically scanned for known vulnerabilities

Service Level Agreements

We provide enterprise-grade service commitments to ensure reliability and support:

• Incident Response SLAs: Critical (1 business day), High (3 business days), Medium (7 business days), Low (14 business days)
• Uptime Guarantee: We target 99.5% uptime availability with proactive monitoring
• Zero-Downtime Deployments: Blue-green deployment strategies and rolling updates

Questions?

We believe transparency builds trust. If you have questions about our security practices, compliance standards, or would like more detailed information, please reach out: