Trust Center

Each user is given access to the system based on roles and permissions. Once the permissions are established the authentication application to verify the user and their access and provide a unique token to access IntegrityCounts after the user has logged in. For a more streamlined sign in experience, WhistleBlower Security can also integrate with the client's Single Sign On.

WhistleBlower Security uses Microsoft Azure PaaS and monitors 24/7.

Data is stored in Azure datacentres – both primary and backup – and a number of physical security controls are in place to ensure data is protected.

Incidents are managed according to the ISO 27001:2013 protocol. This protocol is outlined in the WhistleBlower Security Incident Response Policy above. If an incident become a disaster the above Disaster Recovery Policy takes affect. Incidents are then managed through corrective action plans to correct the issue and ensure it does not occur again.

WhistleBlower Security is currently on the ISO certification schedule. Internal audits are performed every year, a full external audit completed every three years and a lighter external audit performed on the off years. Penetration and Vulnerability testing is also performed every year.

WhistleBlower Security employs a variety of tests both internal and external, along with a regular scanning to ensure the safety of your data. Some of these efforts include but are not limited to TinHat security vulnerability scanning, rigorous intrusion detection and prevention systems, SAST testing against source code on every release, Firewall services, regular anti-virus & anti-malware updates, Microsoft Advanced Threat Detection, Microsoft Patching & Hardening processes, and yearly vulnerability & penetration testing. Check out Microsoft Azure’s data protection controls learn more about Microsoft Azure’s additional measures to keep your data safe.

WhistleBlower Security's primary data centres, located in Canada, maintain the requirements for policies, procedures and processes in compliance with ISO27001, SOC1, SOC2, FedRAMP, SAA16, and CSAE 3416.

WhistleBlower Security is GDPR compliant by adequacy status. The EU has made a formal decisions to recognize that Canada has an equivalent level of personal data protection as the EU. By following the data protection laws in Canada, we are by default GDPR compliant.

Encryption is used to secure data both in transit and while at rest. All incident report details are encrypted. WhistleBlower Security maintains strict controls over who has access to systems that store confidential data. All data / information transmission is done using encrypted methods.

Data is stored in a central database and is only accessed via web portal using Transport Layer Security (TLS 1.2) encryption. Other documents would be transferred using a secured file sharing service that also utilizes SSL encryption. Data / information would not be transferred directly using electronic messaging or physical shipment.

Data is also segregated on a client by client basis to ensure the integrity and security of the data. The information is encrypted using TLS between the client and the server. Once on the server, the structured data is encrypted into an MS SQL Azure RDBMS using Transparent Data Encryption (RSA-2048) with certificate Signature Algorithm : PKCS #1 SHA-256. Any uploaded attachments are encrypted into Azure blob storage using Azure Storage Encryption. The certificates are managed at the platform level, allowing decryption only by the calling application and from specified hardware locations.

See information on “Regular Vulnerability Scanning" in the Data Safety & Security section. WhistleBlower Security also maintains ISO27001 certification with regular annual audits to ensure that policy and procedure offers the highest data protection.

IntegrityCounts data is stored in Canada on Microsoft Azure SaaS and PaaS for the highest level of data control and security with limitless scalability. Check out Microsoft Azure’s rigorous data protection controls to learn more. The service retains certifications with the highest global ratings for data security (SOC 1, SOC 2, ISO2700, FedRAMP, SAA16, and CSAE 3416).

To help protect against data loss, IntegrityCounts database maintains an uptime of 99.5%. Microsoft Azure stores and backs up IntegrityCounts data at 2 data centres across Canada; multi-replication and instant switch approach (ISA) guarantees the speed of data recovery. Database recovery points are every 10 minutes (RPO), and data can be restored within a total of 120 minutes (RTO) so that you can access your data at any given time.