Introduction
Autorox is a cloud-based Software-as-a-Service (SaaS) platform hosted on Amazon Web Services (AWS) and designed to help garages manage their day-to-day operations. To ensure the confidentiality, integrity, and availability of customer data, Autorox has implemented this security policy.
 
Security Measures
Autorox implements a number of security measures to protect customer data, including:
 
a. Physical Security: Autorox leverages the physical security measures provided by AWS, including secure data centers with access controls, biometric authentication, and 24/7 surveillance.
 
b. Network Security: Autorox uses firewalls and intrusion detection systems to protect its network from unauthorized access, in addition to the network security measures provided by AWS. Regular security audits are performed to identify and address any vulnerabilities.
 
c. Data Encryption: All customer data stored by Autorox is encrypted using industry-standard encryption algorithms, including data stored in transit and at rest. AWS also provides encryption services for data stored on its servers.
 
d. Access Controls: Autorox implements strict access controls to ensure that only authorized personnel have access to customer data. Access is granted based on job function and is reviewed regularly, in conjunction with the access controls provided by AWS.
 
Incident Response
Autorox has established an incident response plan to quickly respond to and resolve any security incidents, including those related to AWS. This plan includes procedures for identifying, reporting, and responding to security incidents, as well as steps to prevent similar incidents from occurring in the future.
 
Customer Responsibilities: 
Application security awareness is critical to your business. It is important to understand and have knowledge of how to protect sensitive information related to your customers from unauthorized access, use, disclosure, disruption, modification, or destruction. Autorox has been built in a way that your data is kept secure on the cloud with all the data security and protection compliances in place. However, there are also chances of data breaches due to non-functional aspects such as personnel compromise, data theft, etc.
 
And thus, the application security is a shared responsibility of the stakeholders of Customers and Autorox. So, it is imperative that both parties perform the necessary steps to ensure application security.
 
As part of the measures to be taken to ensure application security, we strongly recommend all the stakeholders of our customers look after the below points to make sure the data is fully protected and secure.
 
1. Reset the Autorox system passwords for all users every 30 days.
 
2. Autorox has a mechanism in place where OTP is shared only with the authorized email address and mobile number to get access to download the report. This ensures that only authorized personnel can download the report. So, it is recommended to keep the OTP controls ON at all times to access the reports. (Refer to the steps below on how to keep the OTP controls ON).
 
3. Most often, you would have a common Email ID for the company, for which access is available to multiple employees in your business. Be careful to not use this common Email ID for getting the OTP for report download. Use only an authorized person's (e.g., business owner) mobile number and email address to get the OTP.
 
4. Ensure that the password of the authorized person's email address is changed every 30 days.
 
5. Make sure the authorized person's phone should not be kept unattended as this phone would be receiving the OTP for downloading the report and any unauthorized person can get access to download the reports.
 
6. Regularly train employees on Reasonable Security Practices & Procedures and make sure they understand the importance of data security. Have regular audits internally to ensure no one has the access to the admin login or to the authorized person’s device.
 
7. Give the report download option only to authorized personnel so that the reports and the sensitive information in the reports are available only to authorized personnel.
 
8. After reviewing the downloaded reports, ensure the downloaded reports are deleted from the system or device where the report has been downloaded.
 
9. If the report is received over email, after reviewing the report, delete the email on which the report was received.
 
10. If the downloaded report must be stored, lock the report with a strong password so that even if someone gets access to the file, they would not be able to open the excel report without the password.
 
11. To disable the report download option for users, follow the below steps:
Sidebar> Configure> Workshop profile> User.