Wealthbox is a web-based customer relationship management (CRM) application designed for financial advisors and their firms to track their clients and collaborate as a team to get work done. The Wealthbox CRM product is designed, developed, operated, supported, and owned by Starburst Labs, Inc., based in New York City.
Wealthbox hosts its application with Amazon Web Services, a leading infrastructure and hosting services provider. We apply security controls at every layer from physical to application and isolate customer applications and data. We also apply best practices and other security techniques to ensure the safety and security of our customer data.
Wealthbox follows best practices of application development and prevents common web software attacks. We use modern technologies and consistently update of our application framework for newly discovered security vulnerabilities. Our development process includes continuous vulnerability scanning to ensure our team is maintaining this high level of security in our codebase.
Wealthbox’s physical infrastructure is hosted and managed within Amazon’s secure data centers and utilize the Amazon Web Service (AWS) technology. Amazon continually manages risk and undergoes recurring assessments to ensure compliance with industry standards. Amazon’s data center operations have been accredited under:
Our application traffic runs entirely over 256-bit encrypted SSL (https). Passwords are hashed before storing using bcrypt with a cost factor of 10 and application credentials are kept separate from the database and our code base. Additionally, sensitive data is stored in an encrypted format while at rest.
In addition to usernames and passwords, Wealthbox user can enter a code from their mobile phone, adding an extra layer of security for your account.
Users of Wealthbox can set a session timeout to their preference which will automatically logout a user when there’s no activity for a selected period of time.
All user data on Wealthbox is backed up nightly and stored in multiple physical locations to prevent data loss. We have the ability to do point-in-time recovery of our entire database in the event of a system-wide emergency.
Wealthbox uses PCI compliant payment processor Stripe for encrypting and processing credit card payments. Stripe has been audited by a PCI-certified auditor, and is certified to PCI Service Provider Level 1. This is the most stringent level of certification available. Credit card numbers are not stored on the Wealthbox platform.
Wealthbox utilizes ISO 27001 and FISMA certified data centers managed by Amazon. Amazon has many years of experience in designing, constructing, and operating large-scale data centers. This experience has been applied to the AWS platform and infrastructure. AWS data centers are housed in nondescript facilities, and critical facilities have extensive setback and military grade perimeter control berms as well as other natural boundary protection. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, state of the art intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication no fewer than three times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff.
Amazon only provides data center access and information to employees who have a legitimate business need for such privileges. When an employee no longer has a business need for these privileges, his or her access is immediately revoked, even if they continue to be an employee of Amazon or Amazon Web Services. All physical and electronic access to data centers by Amazon employees is logged and audited routinely.
Automatic fire detection and suppression equipment has been installed to reduce risk at Amazon facilities. The fire detection system utilizes smoke detection sensors in all data center environments, mechanical and electrical infrastructure spaces, chiller rooms and generator equipment rooms. These areas are protected by either wet-pipe, double-interlocked pre-action, or gaseous sprinkler systems.
The data center electrical power systems at Amazon are designed to be fully redundant and maintainable without impact to operations, 24 hours a day, and seven days a week. Uninterruptible Power Supply (UPS) units provide backup power in the event of an electrical failure for critical and essential loads in the facility. Data centers use generators to provide backup power for the entire facility.
Climate control is required to maintain a constant operating temperature for servers and other hardware, which prevents overheating and reduces the possibility of service outages. Data centers are conditioned to maintain atmospheric conditions at optimal levels. Monitoring systems and data center personnel ensure temperature and humidity are at the appropriate levels.
Data center staff at Amazon monitor electrical, mechanical and life support systems and equipment so issues are immediately identified. Preventative maintenance is performed to maintain the continued operability of equipment.
For additional information see: https://aws.amazon.com/security.
You can report security vulnerabilities to security@wealthbox.com. If you have sensitive information that you would like to provide, please use Wealthbox’s public key, located here.
If you have any specific questions regarding our security policies you can always email us contact@wealthbox.com.
