Security Practices
Our goal is to unleash the potential of RFID for every project for clients of any size and industry, and in turn, help advance humanity through the power of RFID technology and software.
We know that your information is the heart of your business and life, thus the reason why security is one of our top priorities. We're transparent with our security practices so you can feel informed and safe using our products and services.
Encryption and Key Management
Encryption in transit
All customer data stored within Senitron cloud products and services is encrypted in transit over public networks using Transport Layer Security (TLS) 1.2+ with Perfect Forward Secrecy (PFS) to protect it from unauthorized disclosure or modification. Our implementation of TLS enforces the use of strong ciphers and key-lengths where supported by the browser.
Encryption at rest
Typically Senitron cloud is not required to maintain financial or sensitive data, thus full DB encryption or Drive encryption is generally not practiced, instead only specific fields such as user names, emails, and passwords are encrypted, as well as uploaded user files (such as handheld RFID read files, which do not contain sensitive data). Concurrently, for government projects, and or other sensitive projects these features are offered on demand for additional fees.
Government & Sensitive Project
For sensitive projects we typically accommodate full disk, industry-standard AES-256 encryption at rest, as well full DB encryption. Data encryption at rest helps guard against unauthorized access and ensures that data can only be accessed by authorized roles and services with audited access to the encryption keys.
Database Encryption
Specific database fields and tables which may contain sensitive information, such as user names, emails, and or financial data are encrypted for extra protection.
Encryption key management
Senitron uses the AWS Key Management Service (KMS) for key management. The encryption, decryption, and key management process is inspected and verified internally by AWS on a regular basis as part of their existing internal validation processes. An owner is assigned for each key and is responsible for ensuring the appropriate level of security controls is enforced on keys.