Is USIncomeVerify Secure?
At USIncomeVerify, we realize that the data we hold is extremely important to you and your family. That's why we take every precaution to ensure that your data is safe.
Application Security Measures
USIncomeVerify employs several security measures within its application to ensure that the data stored in the system and disseminated by the system is secure and backed up. Some of the different security keypoints that the system employs are as follows:
- HTTPS Access
All web clients are forced to communicate with the employment and income verification application over the HTTPS protocol. Any requests made to the server outside the HTTPS realm are converted to HTTPS and redirected. No requests to the application can be made over unsecured HTTP.
- Digital Certificates
All USIncomeVerify web servers utilize a digital certificate issued by Entrust digital certificates. Information on Entrust certificates can be found at www.entrust.net.
- Application Login Credentials
All users of the system are required to provide 2 tokens and a password to login to the system. Multiple failures of login attempts will lock out the account helping to eliminate repetitive attempts on a single account.
- Remote VPN Access
All remote access to USIncomeVerify systems is done through the USIncomeVerify office. Access to the production servers requires specific IP filters within the firewall and only SSH and SQL*Net traffic is allowed from the USIncomeVerify office. Employees who need to access the office remotely do so through a Cisco VPN using unique logins for each remote user. Each remote user must have their specific IP address allowed through the USIncomeVerify office firewall into the VPN server. Once authenticated to the USIncomeVerify office VPN, the user must then route through an additional Cisco VPN tunnel via SSH to the production data facility.
- Data Facility and Firewalls
The employment and income verification application is hosted at a Tier 1 disaster/recovery center inside a secure facility which provides 24/7 video surveillance monitoring as well as an engineer on the floor 24/7. All access to the facility is done through biometric access. All access to the employment and income verification application servers is done through a firewall and no external access is granted to either the application servers or the database server. Each tier of the application (Web, Application, Database) is partitioned into firewalled DMZ's.
- Routine Security Scans
USIncomeVerify utilizes the services of ScanAlert to perform daily penetration scans of its production services. ScanAlert provides daily reports to USIncomeVerify on any vulnerabilities it may have encountered during a scan. ScanAlert certifies the USIncomeVerify employment and income verification application to be "Hacker Safe".