Security

Phrase Security Statement

Introduction

This security statement applies to the products, services and applications offered by Phrase. The protection and reliability of customer data is our utmost priority. Our security system is based on the principles of high resilience, transparency and third-party evaluation in accordance with the globally recognized security standards. We believe that Phrase architecture based on a public cloud service with multi-tenant model and logical access controls provides the best value and protection to confidential data of our customers such as translations, translation memory files, etc.

Certifications

Phrase a.s. (formerly Memsource a.s.) has been certified for ISO 27001 which proves that the information security management system (ISMS) which we have introduced conforms to the ISO standard. The ISO certificate was renewed for years 2020-2023.

We use Amazon web services (AWS) as our cloud provider. AWS is compliant with a wide range of security standards including SOC 1/ISAE 3402, SOC 2, SOC 3, FISMA, DIACAP, and FedRAMP, PCI DSS Level 1, ISO 9001, ISO 27001, ISO 27017, and ISO 27018.

We use a third-party payment provider that is PCI DSS compliant and uses additional security mechanisms such as MasterCard SecureCode, Verified by VISA and SafeKey.

Audits and Vulnerability Detection

Phrase services undergo third-party penetration tests each year. The tests are conducted in accordance with the OWASP ASVS standard.

We operate a third-party hosted vulnerability disclosure program allowing independent researchers to responsibly disclose any vulnerabilities they may find in our applications and services.

We use a third-party service for monthly automated vulnerability scans.

Our information security management system is subject to annual internal audits and third-party audits verifying our compliance with the ISO 27001 standard.

Data Control

The data in your Phrase account is protected. Only users who you have provided appropriate user rights to have access to your content. Instead of emailing data, users access data upon authentication in Phrase (see Access Control) and all user actions are logged.

All stored data is encrypted using Linux LUKS (aes-xts-plain64:sha256) or AWS encryption (AES256).

Data Centers and Locations

Phrase service is hosted on Amazon Web Services (AWS) platform. The physical servers are located in AWS data centers. User content can also be found in backups, stored in AWS S3.

Production Environment

We maintain separate and distinct development, QA, pre-production and production environments.

To access the Phrase production environment, authorized and trained members of the Phrase Engineering team members use VPN and authenticate using unique strong passwords and 2FA.

Change Management

Phrase uses a formalized IT change management process designed to ensure that changes are authorized and operate as intended.

The change management system in Phrase follows these principles:

• All software development follows the best practices documented in Phrase policies and documentation of particular components.
• All changes are documented and approved by the relevant team lead.
• All changes are tested in the QA and pre-production environments prior to deployment to the production environment. Changes are approved only if they fulfill predetermined criteria. The development and QA environments use testing data and do not include real customer data.
• All changes which affect applied security measures or risk profile of the Phrase service are assessed by Phrase’s information  a security team.
• In case of a major change, penetration tests and/or vulnerability tests are performed.

Access Control

Access management in Phrase is guided by the following principles:

Principle of Least Privilege

Access privileges for any user should be limited to resources absolutely essential for completion of assigned duties or functions, and nothing more.

Principle of Segregation of Duties

Whenever practical, no single person should be responsible for completing or controlling a task, or set of tasks, from beginning to end when it involves the potential for fraud, abuse, or other harm.

Personalized profiles

Whenever possible, user profiles are personalized, e.g. tied to the identity of one specific user.

Single identity

Wherever possible, user profiles use a single authentication provider (such as Google ID) and single credentials. Multi-factor authentication is enabled when supported by the authentication provider.

User responsibility

The user is responsible for the protection of the authentication means (username, password, means of multi-factor authentication) and all actions performed under their profile. The administrator of the IT system / application is responsible for the use and protection of technical profiles.

Event Logging

We store logs related to system and applications events and also related to any user activity within their Phrase account. We have centralized log management in the form of a third-party service.

Audit logs relating to a customer’s use of the platform are available to Phrase engineers and can be provided upon request.

Login history (including IP address, country and user agent identification) is available to each user and accessible via the UI.

Encrypted Communication

All communication is encrypted by default. This includes communication between Phrase servers and the user’s web browser, the Phrase CAT desktop editor and the mobile application.

Phrase uses industry standard encryption for data in transit. They are encrypted by TLS 1.2. The identity of the connection to Phrase is verified by a secure certification authority.

Redundancy and Backups

Redundant architecture provides for a high service up-time. All data is kept in several redundant database instances. All data is backed up through near real-time incremental backups as well as daily full backups to a highly durable storage hosted in AWS S3. Backups are encrypted using Linux LUKS (aes-xts-plain64:sha256) or AWS encryption (AES256).

Disaster Recovery and Incident Response

We apply disaster recovery and incident response policies that facilitate  timely and effective reactions to incidents. This helps us in our efforts  to maintain high service availability, and to promptly recover from  disaster events with  minimal data loss. The performance of our disaster recovery is measured by Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

RTO is the targeted duration of time in which a business process must be restored after a disaster (or disruption) in order to avoid unacceptable consequences associated with a break in business continuity. Phrase proved in tests to reach an 8 hour RTO for all components of its service.

RPO is the maximum acceptable amount of data loss measured in time. It is the age of the files or data in backup storage required to resume normal operations if a computer system or network failure occurs. RPO covers incidents that require complete recovery of all database instances. In case only one database instance is affected by the incident, the production environment seamlessly switches to another instance. Phrase reaches a 4 hour RPO even in case of a catastrophic failure.

Physical Security

Although most of the assets of Phrase are cloud-based, company policy ensures the protection of the physical premises as well as the information assets stored herein.

Our premises are protected by a security service that is present 24/7. The entrance to the building is monitored by CCTV cameras. Security controls all access points to the building including emergency doors.

In general, Phrase premises are only accessible to Phrase employees and long-term contractors. These persons are holders of tokens granting access to the general office area, excluding restricted areas.

Visitors are registered at the reception desk that operates 24/7. Based on their registration, they are only given access to the lift area. To access Phrase premises, they must be accompanied at all times by a Phrase employee. All Phrase employees are responsible for keeping their visitors accompanied at all times during their visit and not granting them any unnecessary access to any information assets belonging to Phrase.

Hard copies of classified information may be stored only in locked closets located in the Phrase office. Access to those documents is granted only to employees who require it for the performance of their duties.

Classified IT assets are stored in the server room. Access to the server room is only granted following confirmation by a designated Phrase employee. Phrase’s information assets are stored separately from the equipment of other tenants in locked racks.

Employee Policies

Phrase personnel are obliged to act in line with legislation, rules and procedures described in this and related policy documents. They are responsible for the security of assets entrusted to them by Phrase. Any misconduct or violation of the aforementioned obligations may lead to disciplinary measures according to applicable labor legislation.

A centrally managed and automatically updated anti-malware solution is installed on all computers.  All devices have full disc encryption enabled and are protected by strong password and/or biometrics. Phrase users have to follow these policies even when using their own devices. Clean desk policy provides rules for securing the devices when not attended and for safe storage of internal and classified information only in the designated protected areas.

Users have to create unique, complex and not easily guessable passwords for all work-related accounts. Remote access to the internal Phrase network is only possible through company managed VPN.

All prospective Phrase employees and contractors are subject to background checks in line with privacy legislation. Security awareness training is part of our on-boarding process and is repeated annually. All employees and contractors are subject to confidentiality undertakings as part of their contractual arrangements.