EmployeeVoice

Allegiance Security and Data Recovery Plan

Security

We aggressively ensure our systems are secure by approaching security from three different facets: 1) hardware protection, 2) prevention of vulnerabilities to a web-based attack, and 3) measures that prevent information from being compromised from employees with access to any customer data.

Our hosting services company ensures the security of our hardware with biometric and other access checks at the housing facility. To provide web protection, our service partner has in place firewall protection, stoppage of all unused processes in the operating system, and keeps the database server protected from direct exposure to the web.

A full test of Allegiance security test and security audit is run on a weekly basis by a qualified independent testing and vulnerability analysis company. In addition, spot checks of Allegiance security are run as requested during the year. Besides employing the protection of these companies, Allegiance takes stringent measures to guard the confidentiality of the information gathered via our systems. Our processes ensure that each employee with access to information is trained on confidentiality and he or she signs an agreement detailing the confidentiality of this information.

Recovery

This document outlines the practices and procedures Allegiance™ will follow in the event unforeseen events result in possible service interruptions or system failure.

Web Server
The Allegiance web server operates using IIS 5.0 from Microsoft. Allegiance uses a version of IIS 5.0 current on all Microsoft security updates and is continually informed of the latest updates available. The web server interacts with a JSP engine, Jrun from Macromedia, via an ISAPI extension. The web server is backed up monthly with daily incremental backups. In addition to the source code contained on the web server, Allegiance maintains backups of this source code on multiple computers located outside of the hosting facility. In the case of catastrophe at the hosting facility, the application will be restored on a computer within a few hours. The web server is monitored every five minutes by the hosting facility using site monitoring software.

Data Server
Allegiance protects data stored in its databases in a number of ways. First, the dedicated data server is fully backed up monthly with daily incremental backups. All backups are held both local to the machine and off-site. Second, frequent (once a week or more) non-automated backups are performed. Third, passwords are set up in a way to make them secure, requiring at least 8 characters in length with upper and lower case alpha characters, numbers and other special characters. Fourth, logins are currently limited to only allow two individuals per connection.

Hosting Facility
Allegiance has selected a third party hosting service who's main offices and data center are separate and the data center is protected in the following ways:

• Biometric identification entrance process
• Access limited to specifically authorized personnel
• 24/7 security
• 24/7 video surveillance
• 24/7 environmental monitoring
• 24/7 network monitoring
• Fire suppression system: Vesda
• Dual UPS's for all machines for up to 7 hours when outside power is lost
• Diesel generator power backup system; could run data center indefinitely
• Locked cages and cabinets, preventing access to equipment even if someone were able to gain entry to the data center
• Backups stored securely off-site
• Multiple spare parts and a policy of at least one extra server available at all times
• Agreement with multiple data centers to host our application within 24 hours if the data center becomes non-operational (including IP redirection)
• Comprehensive written procedures and policies to ensure consistency and quality of service
• Connections to multiple Internet backbones through OC3 lines within a major telecommunications hub

Ongoing Enhancements
In addition to the recovery information provided here, Allegiance is continually evaluating its recovery plan.

Request more info about EmployeeVoice