Security highlights
Protecting customer information is a priority for Indicio.
01 Workforce Security
Security Training and Awareness: staff receive regular security training.
Access Control: access to sensitive systems follows the principle of least privilege.
Incident Reporting: defined procedures exist for reporting vulnerabilities, and backup and recovery processes protect data integrity and availability.
02 Security Frameworks and Compliance
Indicio is ISO 27001 certified for its data warehouse and adheres to the standard.
Servers hosting customer data are reachable only through a two-factor-secured VPN. Logging and auditing are used to prevent improper access, and employees undergo mandatory screening.
03 Business Continuity Program
The program covers risk management, emergency response and recovery, addressing natural disasters, cyberattacks and system failures.
Risk Assessment & Business Impact Analysis: regular risk assessments and business impact analyses are performed.
Incident Response Plan: a defined incident response plan is in place.
Frequently asked questions
Is my information used for training an AI?
No. Each customer has a closed, secure data environment. Customer data and forecasting results are not used for AI training or shared.
How does Indicio keep my data secure?
Through encryption, trained staff and technical safeguards including hashed passwords, DDoS mitigation, multi-factor authentication, threat intelligence, automated scans, penetration testing and a vulnerability reporting program.
How does Indicio ensure my privacy?
Indicio follows its published privacy policy and a data minimization policy under which logs are deleted after 30 days.
Does Indicio encrypt customer data?
Yes, in transit and at rest. Data at rest is encrypted with AES-256.
How does Indicio prevent unauthorized access?
Data is hosted in third-party data centers separate from corporate offices, with VPN-only server access, logging, auditing and staff screening.
Is Indicio GDPR compliant?
Yes.
What customer information does Indicio store?
Billing information, user credentials and location for access, audit logs, uploaded or synced data, forecast results and third-party integration credentials. Encrypted database backups are kept for 3 months. Data is deleted or anonymized after subscription termination.
How does Indicio respond to government or law enforcement requests for data?
Data is shared only in limited situations such as valid legal requests, enforcing terms, or emergencies. Requests are reviewed for legal compliance and answered as narrowly as possible.
Does Indicio support 2-factor authentication?
Yes, through Google Authenticator and Authy, with more providers planned.
Does Indicio adhere to secure coding guidelines?
Yes, including the OWASP Secure Coding Practices.
How can I report a security vulnerability to Indicio?
Contact security@indicio.com.
How does Indicio use query data?
To provide the services (returning results, recommending indicators, sending configured notifications) and to develop and improve offerings using unattributed data. Query logs are kept for 30 days and may be used for security or technical issues or valid legal requests.