Secure Data Exchange technology
At Dawex, trust and security are paramount. Dawex teams aim at consistently maintaining the highest security standards to exchange data safely and easily.
Corporate security
Dawex has a strong focus on security which drives constant attention from the teams. Security and confidentiality are constantly at the forefront of internal discussions, with regular updates being made, where:
- Access to various levels of information within the organization is strictly controlled
- Data and systems access authorizations are clearly defined and have limited timeframes
- All Dawex employees are bound by a confidentiality clause in their employment contract
- Subcontractors who work with Dawex are also bound by Non Disclosure Agreements
Security audits
Dawex maintains active System and Organization Control (SOC) 2 Type II and SOC 3 compliance, which ensures the implementation of internal controls for security, availability, processing integrity, confidentiality and privacy. These audits also assess and certify the design of security processes and controls conducted by Dawex, including criteria and controls for ensuring the security and privacy of data. Download the latest SOC 3 audit report.
Additionally, Dawex Data Exchange technology undergoes rigorous annual external audits performed by security experts, which include comprehensive penetration tests. These audits are conducted to assess the security of the Dawex solution Data Exchange Platform and its underlying code, as well as to identify any vulnerabilities or weaknesses that may exist. By regularly conducting external audits, Dawex demonstrates its commitment to maintaining a secure platform for the users and to continuously improving security measures to stay ahead of emerging threats.
Data distribution security
Dawex has taken significant steps to establish robust mechanisms for ensuring the security of data exchanged through its technology. These measures enable Data Exchange Platform orchestrators to create and manage a secure and trustworthy data exchange ecosystem.
The mechanisms include:
- Identification, authentication, and authorization protocols, which include the use of two-factor authentication for console access to enhance security and accountability
- Full infrastructure monitoring to detect and address potential issues before they can cause harm to the system or compromise data security
- Implementation of ModSecurity WAF mechanisms based on OWASP Rulesets to enhance the system's security by detecting and blocking common web application attacks
Encryption and privacy
Dawex builds security through privacy-by-design, and has implemented state-of-the-art measures to ensure the protection of personal and activity-related data.
These measures include:
- Use of asymmetric encryption protocols to store and transmit data, ensuring that all data is kept secure and private
- Encryption of all personal and activity-related data to provide an additional layer of security and privacy, with end-to-end encryption of all transmissions to prevent unauthorized access or interception
- Strict authentication and logging of all network flows to monitor for potential security breaches or unauthorized access
- Application and API accessibility through asymmetric encrypted protocols, ensuring that all data transmission is secure and private
- Use of reverse proxies to filter streams and network Access Control List (ACL) to isolate streams, further enhancing the security of the system
- Implementation of encrypted and hardened systems that follow a minimal installation policy, reducing the risk of system vulnerabilities and attacks
Key management
Dawex recognizes the critical importance of key management in ensuring the confidentiality, integrity and authenticity of data at rest and in transit.
The system includes:
- Implementation of key management protocols to meet the following security objectives: confidentiality of data at rest and in transit, integrity of data at rest and in transit, authenticity of data origin, authenticity of end device, and digital signature
- Use of secure key management algorithms and protocols to ensure that all keys are kept secure and private
- Robust procedures for key creation, storage, and destruction, to prevent unauthorized access or compromise of keys
- Regular monitoring and updating of key management protocols to ensure that they remain effective and up-to-date with the latest security standards and requirements
- Implementation of digital signature mechanisms to ensure the authenticity and integrity of data transmission and reception
- The key management system is designed to work seamlessly with the rest of the security architecture, providing an additional layer of protection to ensure the confidentiality, integrity, and authenticity of all data
Responsible Disclosure
The Dawex security team recognizes that no technology is entirely immune to bugs and vulnerabilities. As such, the team is committed to verifying and resolving any potential security vulnerabilities that may be discovered.
Dawex has implemented a responsible disclosure policy that encourages anyone who discovers a security issue to report it in a responsible manner. This policy ensures that the security team can promptly and effectively address any vulnerabilities, while also maintaining the confidentiality and privacy of the reporter.
Dawex believes that responsible disclosure is critical for maintaining a secure and trustworthy technology, and is committed to working collaboratively with the security community to ensure the highest levels of security for all users.
Looking for a Data Exchange technology that matches your business needs?
With the Dawex solution Data Exchange Platform, you can support any data exchange strategy and any business model, and easily customize your organization’s white label Data Hub or Data Marketplace.
