Frequently Asked Question (FAQs)

Privacy

Do you have a data processing agreement (DPA)?

Yes, customers using Structural Cloud, Ephemeral Cloud or Textual Cloud have a DPA included as part of our standard terms of service.

For a copy of our standard DPA, our sub-processor list, and our technical organizational measures (TOMs), go to www.tonic.ai/terms/dpa.

Do you use sub-processors to provide your Cloud services?

Tonic uses a variety of sub-processors to deliver Tonic Cloud services. These include organizations, such as Amazon Web services, that provide the underlying infrastructure of our applications, and other vendors for:

  • Account management

  • Customer support,

  • Application development

  • User research

  • Credit card processing

Our DPA includes a list of Tonic's sub-processors for Tonic Cloud applications. To view the DPA, go to www.tonic.ai/terms/dpa.

How can I be notified of new sub-processors?

To sign up for notifications of new, changed, or removed sub-processors for any Tonic product (Structural, Ephemeral, Textual), complete the form at https://forms.gle/sYCTVGJiVJdHAQDA6.

Identity and Access management

Who has access to Tonic Cloud infrastructure?

Tonic.ai uses the principle of least privilege to grant access to infrastructure.

Tonic.ai has defined roles that grant employees access to Tonic Cloud infrastructure and applications. These roles are based on pre-defined need.

Staff that can access Tonic Cloud infrastructure and data stores include:

  • Solutions architects

  • Platform engineers

  • Security staff

Other staff who have incidental access include:

  • Engineering staff who have specific expertise in specific components

Tonic.ai does not use contractors to manage infrastructure.

How do your employees access Tonic Cloud infrastructure

Tonic.ai employees access Tonic Cloud infrastructure through the AWS Console or through a VPN connection.

Both AWS and the VPN require users to authenticate through our Identity Provider, which enforces multi-factor authentication.

What data can your employees see?

Some Tonic.ai staff are granted access to the infrastructure that hosts Tonic.ai applications or have access management consoles.

However, during their regular job duties, Tonic staff can never see data that is processed or stored by Tonic.ai applications.

Tonic.ai staff can see the data related to the organization, end-user accounts, and configuration of the application.

How are access permissions granted, reviewed, and revoked?

Tonic.ai uses an Identity Provider that automatically grants, updates, and revokes access to:

  • Business applications

  • Infrastructure

  • Software development resources

  • Other internal tooling

Tonic.ai uses the principle of least privilege to grant access to infrastructure.

Tonic.ai uses defined roles to grant employees access to Tonic Cloud infrastructure and applications based on pre-defined need.

At least once a year, Tonic also manually reviews access for vital resources.

Do your employees complete annual training on privacy and security?

All Tonic.ai staff, both employees and contractors, complete initial and annual training in:

  • Security

  • Compliance

  • Privacy awareness

To complete this training, they use an online LMS platform that verifies completion and comprehension.

This training includes:

  • Information security best practices (passwords, MFA, phishing, social engineering)

  • Incident response information (what to look for, who to contact)

  • Data handling and privacy (relevant privacy laws, data classification and handling, disposal)

  • New and relevant security advisories (new threats that employees should be extra vigilant about)

How does the company monitor and audit its employees' compliance with privacy and security policies?

Tonic.ai uses a variety of administrative, technological, and physical controls to monitor our employees' compliance with our privacy and security policies.

These include:

  • Network Monitoring

  • Video Surveillance

  • Data Loss Prevention

  • Regular Security Awareness Training

  • Access Controls

  • Incident Reporting

  • Internal and external auditing

Security and Risk Management

Do you conduct risk assessments at planned intervals?

Tonic.ai performs annual risk assessments of our security and privacy programs.

Testing and assessment

Do you perform penetration tests?

Tonic.ai conducts annual application penetration tests on each of our products.

Application penetration testing proactively identifies and addresses vulnerabilities in each application, which benefits both Tonic Cloud and on-premise customers.

Do you perform vulnerability scanning?

To ensure the highest level of application security, our development process incorporates rigorous testing at every stage.

To identify potential security weaknesses early in the development cycle, we automatically perform both SAST and container vulnerability scanning on every pull request and build.

Do Tonic staff receive security and privacy training?

Tonic staff are required to complete security and privacy, including specific training related to HIPAA, as part of onboarding. This training includes:

  • Security best practices (includes passwords, multi-factor authentication, and other operational security practices)

  • Privacy regulations that affect Tonic (for example, GPDR and HIPAA)

  • Data classification and handling

  • Advisories on new security threats that staff should be aware of

  • Incident procedures (includes what to report, who to report it to, how quickly to report it)

Communications and Network Security

Do you encrypt data in transit?

Tonic.ai applications can either be deployed as a service (Tonic Cloud) or self-hosted by the customer. The following applies to hosted applications on Tonic Cloud.

Ingress web traffic

End-users interact with Tonic.ai applications primarily through web interfaces and consoles. Tonic Cloud applications receive this traffic through high-availability load balancers that terminate all ingress traffic. These load balancers enforce the use of specific protocols and selected strong cipher suites. Specifically, Tonic.ai supports the following TLS protocols:

  • TLS 1.3

  • TLS 1.2

Tonic Cloud supports the following cipher suites:

  • TLS_AES_128_GCM_SHA256

  • TLS_AES_256_GCM_SHA384

  • TLS_CHACHA20_POLY1305_SHA256

  • ECDHE-ECDSA-AES128-GCM-SHA256

  • ECDHE-RSA-AES128-GCM-SHA256

  • ECDHE-ECDSA-AES256-GCM-SHA384

  • ECDHE-RSA-AES256-GCM-SHA384

These protocols and cipher suites currently rank as A or higher by Qualys SSL Labs testing (View the results: Structural, Textual, Ephemeral, Validate)

Tonic uses ciphers and algorithms defined by AWS as ELBSecurityPolicy-TLS13-1-2-Res-2021-06 and ELBSecurityPolicy-TLS13-1-3-2021-06. For more information about these, to go to the AWS documentation.

Ingress SSH traffic

Some Tonic.ai applications, such as Ephemeral, might create ingress SSH tunnels that allow end-users and customer applications to access Tonic Cloud resources that require connection using other protocols. For example, to connect to a database.

For ingress SSH connections, Tonic.ai supports the following SSH ciphers:

  • chacha20-poly1305@openssh.com

  • aes128-ctr

  • aes192-ctr

  • aes256-ctr

  • aes128-gcm@openssh.com

  • aes256-gcm@openssh.com

Egress traffic

To retrieve the data needed to process and to load data into other systems, as configured by customers, Tonic.ai applications connect to:

  • Databases

  • Applications

  • Data warehouses

  • File storage systems

  • Other external resources

Tonic.ai applications supports a wide variety of databases, applications, and data connectors. They support many versions of each. To maintain support for older connector drivers and different customer configurations, Tonic Cloud does not disable older, broken, or less secure ciphers and modes that might not be recommended for use.

Customers should ensure the systems that connect to Tonic Cloud applications have encryption policies in place that enforce protocols and ciphers that meet your organization's security policies.

Do you use firewalls / web application firewalls?

Tonic applications can either be deployed as a service (Tonic Cloud) or self-hosted by the customer. The following applies to applications that are hosted on Tonic Cloud.

Tonic Cloud applications are deployed behind high-availability load balancers. The load balancers are configured with both network and web application firewalls.

Tonic Cloud uses both stateful and stateless network firewalls. To minimize the network attack risk, they are configured with "default deny". Traffic is allowed only on pre-defined ports from specified locations.

Tonic.ai also uses web application firewalls to:

  • Protect against common web exploits

  • Reduce bot traffic

  • Filter out traffic from known malicious resources

Tonic.ai updates its web application firewalls regularly using rulesets and threat intelligence from both commercial vendors and open source threat intelligence.

Security Architecture

Where are your data centers located?

Tonic Cloud uses Amazon Web Services global infrastructure to host all Tonic Cloud services. Currently Tonic Cloud is deployed in two data tenancies.

United States tenancy

Tonic Cloud uses AWS US East (N. Virginia) as our primary data center in the US. It uses US West (Oregon) for out-of region backups and disaster recovery.

Tonic Cloud hosts the following services in the United States:

  • Structural

  • Ephemeral

  • Textual

  • Validate

European tenancy

Tonic Cloud uses AWS Europe (Frankfurt) as our primary data center in Europe. It uses Europe (Stockholm) for out-of region backups and disaster recovery.

Tonic Cloud hosts the following services in Europe:

  • Structural

Do you back up your data? If so, how often?

Tonic Cloud services are backed up automatically every 24 hours.

We store a copy of these daily backups in the primary region.

For disaster recovery situations, we send another copy to a geographically different region.

How does Tonic.ai dispose of data at the end of the contract?

Tonic Cloud stores customer data in AWS-managed resources during the lifetime of the contract.

At the end of the contract, Tonic.ai deletes the data from AWS resources. When the device is removed from service, AWS handles the destruction of the physical media.

For information about the AWS security and compliance posturing, go to the AWS Compliance site.

Last updated