DrugPak is now SOC 2 Type 2 compliant
An independent auditor has examined our security controls and confirmed not only that they are designed appropriately, but that they operated effectively over a sustained review period. This report builds on the safeguards described throughout this article.
To request a copy of our SOC 2 Type 2 report, visit our trust center!
Compliance & certifications
PCI DSS
What security certifications does the hosted solution have?
Has DrugPak experienced any security breaches?
No.
Do you perform vulnerability assessments and penetration testing on the infrastructure? If yes, at what frequency?
Yes. The system is scanned after every configuration change, including hardware additions, software installations, updates, and patches, and at least quarterly. A self-security audit is performed annually, and our security controls are also independently reviewed as part of our SOC 2 Type 2 audit.
Scans check for:
Hosting & operations
Who does your company outsource or subcontract any of the services you provide to?
| Provider | Service |
|---|---|
| Microsoft Azure | Application and data hosting |
| Twilio | Fax and SMS services |
| Authorize.net | Payment processing |
Is any part of the application or data hosted on servers physically located outside of the USA?
No.
Is the hosted solution high availability?
Yes. Screenhubb is hosted in the Microsoft Azure East datacenter and uses Microsoft Azure SQL, which offers an SLA of 99.99% uptime. See the Azure SLA summary.
Is your system scalable?
The environment load-balances across sets of redundant application servers and database servers. System administrators are notified automatically when server loads exceed tolerance levels, and additional servers can be provisioned within minutes.
How many concurrent users can use the service at once?
There is no practical limit.
Is the software optimized for low network bandwidth?
Application responses are designed with minimal payloads to perform well on limited bandwidth and mobile devices.
What is your maintenance schedule?
The application is under constant development and new features are added regularly. Updates can be installed without any system downtime. Planned maintenance that does require downtime is announced in advance and performed during off-peak hours.
Are there multiple environments for us to test and migrate (DEV/TEST, STG, PROD)?
A standard DP Web offering provides a single environment. You can start your account as a test account and reset it later.
Our Enterprise Hosting program offers more complex environment options. Contact Sales@drugpak.com or create a support ticket to learn more.
Is our data stored with other customers, or is there a separate database or instance for us alone?
Our standard DP Web offering hosts a single database for all customer data. Data is segregated so only you can see your own data.
Standalone hosting is available through our Enterprise Hosting program. Contact Sales@drugpak.com or create a support ticket to learn more.
Do you have an infrastructure diagram?
Yes.
How does your application handle printing?
Printing is handled through the browser.
Encryption
Is data encrypted in motion?
Yes. Our servers encrypt all communication using Transport Layer Security (TLS 1.2), a protocol that encrypts communication between devices. Many security standards require at least TLS 1.1 and recommend TLS 1.2; ScreenHubb servers require TLS 1.2.
See our browser compatibility chart.
Is the solution TLS 1.2 compliant?
Yes.
Is data encrypted at rest?
Yes. Data files are encrypted at rest using Transparent Data Encryption for Azure SQL.
Access & authentication
Does the system support single sign-on (SSO)?
ScreenHubb supports select single sign-on systems. Details are in the Security - External Login article.
SSO integration for systems that aren't currently supported is subject to custom programming charges, depending on your needs. If you're interested, create a support ticket.
Do you support SAML token federation?
Yes. See the External Login article for details.
Can a user session be terminated after a predetermined amount of inactivity (session timeout)?
Yes. The DP Web session timeout is 30 minutes.
Backup & disaster recovery
What is your backup plan?
The Microsoft Azure SQL database service automatically provides built-in, geo-redundant data backup.
"SQL Database uses SQL Server technology to create full, differential, and transaction log backups for the purposes of Point-in-time restore (PITR). The transaction log backups generally occur every 5 - 10 minutes and differential backups generally occur every 12 hours, with the frequency based on the performance level and amount of database activity. ... The backups are stored in RA-GRS storage blobs that are replicated to a paired data center for protection against a data center outage."
Source: Azure SQL automated backups.
DrugPak Web stores imported documents in disaster-resistant geo-redundant storage (GRS). The Microsoft Azure Storage SLA guarantees that at least 99.9% of the time, the system will successfully process requests to read and write data from GRS storage. See Azure Storage redundancy.
What is your disaster recovery process?
A disaster is declared if Microsoft announces that the affected datacenter will be down for more than 24 hours.
Current contacts are pulled from a database backup located in another region, and announcements are delivered via Constant Contact. Backup restoration is tested monthly.
RTO 30 min
What are your RTO and RPO?
With full backup availability, RTO from the time restoration begins is estimated at 30 minutes.
Our customers receive the same RTO and RPO service level we do. Many of our own critical business functions run on the Screenhubb system, so uptime and data integrity are more than a service level objective to us: a failure in any component of data storage could represent an existential threat to our business. Any concern about system integrity gets immediate diagnosis and remediation, whether the problem is found in "your data" or "our data," "your process" or "our process."
What support services are contractually guaranteed at the time of a disaster?
See the application EULA.
Threat protection & incident response
Does the system provide protection against DDoS attacks?
Yes. DDoS protection is provided through rules on our network intrusion and detection system.
Describe your incident response policy and process.
DrugPak uses a Network Intrusion & Detection System on a firewall. Employees are responsible for reporting system weaknesses, deficiencies, and vulnerabilities associated with reported security incidents to DrugPak's IT Security personnel.
What is the timeline for DrugPak to notify customers of a breach of their data?
A security breach occurs when an individual's unencrypted Personally Identifiable Information (PII) is reasonably believed to have been acquired by an unauthorized person or process. Good-faith acquisition of PII by an authorized user or agent for DrugPak purposes is not a breach, provided the PII is not used or subject to further unauthorized disclosure.
If a breach occurs, notification happens without unreasonable delay, except:
- When a law enforcement agency has determined that notification will impede a criminal investigation, or
- To determine the complete scope of the breach and restore the integrity of the system.
Notification is sent by email and postal mail no later than 60 days after discovery of a breach and includes, to the extent possible:
- A brief description of the breach
- The types of information involved
- Steps affected individuals should take to protect themselves from potential harm
- What DrugPak is doing to investigate the breach, mitigate harm, and prevent further breaches
- Contact information for the covered entity (or business associate, as applicable)
Does DrugPak provide automated security alerts?
Yes. DrugPak emails "Suspicious activity" notifications in the following circumstances:
A login comes from a new IP address more than 100 miles from the previous one.
Alert: Email to the user.
An Account Admin account is created.
Alert: "New Account Administrator Created" email to all account admins, with the new user's name, email, and a link to their account.
A user's database filter is removed.
Alert: "User Database Filter Removed" email to all account admins.
A report lists all participants or all results.
Alert: Email to the originating user, with a link to open a support ticket.
Report generation exceeds 5× the prior month's daily average.
Alert: Email to the originating user.
Document downloads exceed 5× the prior month's daily average.
Alert: Email to the originating user.