Mendix offers an industry-leading application Platform-as-a-Service (aPaaS) for companies to design, build, deploy and manage web and mobile applications. Being a platform provider, it is of utmost importance to ensure that the platform itself, the applications built on the platform and the cloud operations running the platform meet the highest security standards.
Delivering an innovative and secure application platform is the result of comprehensive planning, innovative design, and efficient operations. Mendix makes security a priority at every step, from code development to incident response.
Mendix has adopted a set of security controls from the ISO/IEC 27001:2013 Information Security Framework that govern operations, support and software development life cycles. Mendix has combinations of preventive, defensive and reactive controls to maintain the confidentiality, integrity and availability of the Mendix Platform and customer data.
These controls include:
- Strict access controls on sensitive data, including two-factor authentication or certificate-based authentication to perform sensitive operations.
- Background verification checks on operations personnel involved with customer data.
- Multiple levels of monitoring, logging and reporting, including self-service tools embedded within the Mendix Platform.
- A 24×7 security incident service that works to mitigate the effects of attacks and malicious activity.
- A software development lifecycle which embeds security requirements into systems and software through the planning, design, development and deployment phases.
Within Mendix, we understand that customers trust that the privacy of their information will be protected, and that their data will be used in a way that is consistent with their expectations.
Our customers determine what data is submitted to the Mendix Platform as customer data. With respect to such data, Mendix acts as a data processor and addresses the following privacy commitments:
Mendix permits customers to specify the particular geography where their customer data will be stored. Data may be replicated for backup within a selected geographic area for redundancy, but will not be replicated elsewhere, so customer data will stay under local law and data privacy protection acts.
Access to customer data by Mendix personnel is restricted. Customer data is only accessed when necessary to support the customer’s use of the Mendix Platform after explicit authorization by the customer. Furthermore, strong authentication, including the use of two-factor authentication, helps limit access to authorized personnel only. Access of personnel is revoked as soon as it is no longer needed.
Notification of lawful requests
Our customers should control their data when stored within the Mendix Cloud. We will not disclose customer data to law enforcement except as a customer directs or where required by law. When governments make a lawful demand for customer data from Mendix, we strive to be principled, limited in what we disclose, and committed to transparency.
Together with our customers, we make sure to comply to international data privacy standards, such as the General Data Protection Regulation (EU) 2016/679.
Compliance plays a key role in the trust from, and success for, our customers. We are committed to abiding by the laws and regulations that apply to us as we conduct business around the world. Furthermore, we use international standards to comply as a company or in a joint effort with our customers.
Mendix is ISO/IEC 27001:2013 certified. ISO/IEC 27001:2013 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system and also includes requirements for the assessment and treatment of information security risk tailored to the needs of Mendix and our customers.
Mendix has obtained the following assurance reports with focus on information security controls:
- ISAE 3402 Type II
The ISAE 3402 report is an international standard that focuses on a service organisation’s (security)controls that are likely to be relevant to an audit of a user entity’s (customer’s) financial statements.
- SOC 1 Type II
The SOC 1 report is a US standard that focuses on a service organisation’s (security)controls that are likely to be relevant to an audit of a user entity’s (customer’s) financial statements.
- SOC 2 Type II
The SOC 2 report addresses a service organisation’s controls that relate to operations and compliance, as outlined by the AICPA’s Trust Services criteria in relation to availability and security, two of the 5 Trust Service principles.
Our assurance reports are available for (prospective) customers upon request under NDA. Please send an email with your request to firstname.lastname@example.org or ask your Mendix Account Executive for a copy of the latest reports.