Trust is Important – Controls are Better

Security and Internal Controls for Your Apps and Data at Mendix

Security

Mendix offers an industry-leading application Platform-as-a-Service (aPaaS) for companies to design, build, deploy and manage web and mobile applications. Being a platform provider, it is of utmost importance to ensure that the platform itself, the applications built on the platform and the cloud operations running the platform meet the highest security standards.

Delivering an innovative and secure application platform is the result of comprehensive planning, innovative design, and efficient operations. Mendix makes security a priority at every step, from code development to incident response.

Security Operations
Mendix has adopted a set of security controls from the ISO27001 Information Security Framework that govern operations, support and software development life cycles. Mendix has combinations of preventive, defensive and reactive controls to maintain the confidentiality, integrity and availability of the Mendix Platform and customer data.

These controls include:

  • Strict access controls on sensitive data, including two-factor authentication or certificate-based authentication to perform sensitive operations.
  • Background verification checks on operations personnel involved with customer data.
  • Multiple levels of monitoring, logging and reporting, including self-service tools embedded within the Mendix Platform.
  • A 24×7 security incident service that works to mitigate the effects of attacks and malicious activity.
  • A software development lifecycle which embeds security requirements into systems and software through the planning, design, development and deployment phases.

Privacy

Within Mendix, we understand that customers trust that the privacy of their information will be protected, and that their data will be used in a way that is consistent with their expectations.

Our customers determine what data is submitted to the Mendix Platform as customer data. With respect to such data, Mendix acts as a data processor and addresses the following privacy commitments:

Data Location
Mendix permits customers to specify the particular geography where their customer data will be stored. Data may be replicated for backup within a selected geographic area for redundancy, but will not be replicated elsewhere, so customer data will stay under local law and data privacy protection acts.

Restricted Access
Access to customer data by Mendix personnel is restricted. Customer data is only accessed when necessary to support the customer’s use of the Mendix Platform after explicit authorization by the customer. Furthermore, strong authentication, including the use of two-factor authentication, helps limit access to authorized personnel only. Access of personnel is revoked as soon as it is no longer needed.

Notification of lawful requests
Our customers should control their data when stored within the Mendix Cloud. We will not disclose customer data to law enforcement except as a customer directs or where required by law. When governments make a lawful demand for customer data from Mendix, we strive to be principled, limited in what we disclose, and committed to transparency.

International Standards
Together with our customers, we make sure to comply to international data privacy standards, such as the Health Insurance Portability and Accountability Act (HIPAA) and EU Data Protection Act.

Compliance

Compliance plays a key role in the trust from, and success for, our customers. We are committed to abiding by the laws and regulations that apply to us as we conduct business around the world. Furthermore, we use international standards to comply as a company or in a joint effort with our customers.

ISAE3402 Type II & ISO27001
Mendix has obtained an ISAE3402 Type II assurance report with focus on information security controls. ISAE 3402 is a global assurance standard for reporting on controls at a service organization. It was developed by the International Auditing and Assurance Standards Board (IAASB) to provide a standard that auditors can use to ensure the integrity of an organization’s internal controls. The controls in our security framework are a representative subset of the ISO 27001 Information Security Framework. Our ISAE3402 Type II report is available for (prospective) customers upon request under NDA. Please send an email with your request to security@mendix.com or ask your Mendix Account Executive for a copy of the latest ISAE3402 Type II report.

Our ISAE 3402 Type II certification reflects the diligence and quality Mendix dedicates itself to in every aspect of our operations – from the features in our public-facing platform to the rigorous controls we apply to our own internal processes.

Derek Roos

CEO and Co-Founder, Mendix