Security

Product Security

ThunderQuote website and web application is covered by Cloudflare firewall and DDOS protection, enforcing industry standards and OWASP protocols to defend against xss attacks and other security vulnerabilities. This serves as an additional line of security on top of existing internal security measures.

Our server are also configured to deny any non-recognised connections not routed via Cloudflare DNS. Cloudflare DNS also ensures that our server IPs are not directly exposed. As an additional security measure, sensitive data and administrative functionalities are shielded by multi-factor authentication provided by Cloudflare Access.

Product security is of utmost importance to ThunderQuote. Our team uses a software development lifecycle in line with general Agile principles. When security effort is applied throughout the Agile release cycle, security oriented software defects are able to be discovered and addressed more rapidly than in longer release cycle development methodologies. Software patches are released as part of our continuous integration process. Patches that can impact end users will be applied as soon as possible after undergoing testing in separate servers and downtime is minimised through our off-office hours patching cycle.

ThunderQuote performs continuous integration. In this way we are able to respond rapidly to both functional and security issues. Well defined change management policies and procedures determine when and how changes occur. This philosophy is central to DevOps security and the development methodologies that have driven ThunderQuote adoption. In this way, ThunderQuote is able to achieve extremely short mean time to resolution for security vulnerabilities and functional issues alike. ThunderQuote is continuously improving our DevOps practice in an iterative fashion.

Physical Security

The ThunderQuote production infrastructure is hosted in Cloud Service Provider (CSP) environments. Physical and environmental security related controls for ThunderQuote production servers, which includes buildings, locks or keys used on doors, are managed by these CSP’s. “Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff. Authorized staff must pass two-factor authentication a minimum of two times to access data center floors.”

Corporate Security

ThunderQuote recognizes the diminishing utility of perimeter in relationship to modern network security. Once a perimeter is breached, services that rely on network perimeter security guarantees quickly fall. As such, ThunderQuote leverages internal services that require transport level security for network access and individually authenticate users, commonly by way of a central identity provider and leveraging two factor authentication wherever possible.

All ThunderQuote personnel undergo an annual security awareness training that weaves security into technical and non-technical roles; all employees are encouraged to participate in helping secure our customer data and company assets. Security training materials are developed for individual roles to ensure employees are equipped to handle the specific security oriented challenges of their roles.

Authentication and Access Management

End users may log in to ThunderQuote using their Google, Microsoft, LinkedIn or Facebook accounts via Federated Login or through ThunderQuote accounts in which passwords are stored with salted Blowfish / bcrypt, with minimum password strength enforcement, automatic reset functionality and 2-factor authentication available for organisations.

All requests to the ThunderQuote API must be authenticated. Requests that write data require at least reporting access as well as an API key. Requests that read data require full user access as well as an application key. These keys act as bearer tokens allowing access to ThunderQuote service functionality.

Protection of Customer Data

Data submitted to the ThunderQuote service by authorized users is considered confidential. This data is protected in transit across public networks and encrypted at rest. Customer Data is not authorized to exit the ThunderQuote production service environment, except in limited circumstances such as in support of a customer request.

All data transmitted between ThunderQuote and ThunderQuote users is protected using Transport Layer Security (TLS) and HTTP Strict Transport Security (HSTS). If encrypted communication is interrupted the ThunderQuote application is inaccessible.

ThunderQuote utilizes encryption at various points to protect Customer Data and ThunderQuote secrets, including encryption at rest (e.g. AES-256), asymmetric encryption (e.g. PGP) for system backups, KMS-based protections for the protection of secrets (passwords, access tokens, API keys, etc.) and GPG encryption​.

Access to Customer Data is limited to functions with a business requirement to do so. ThunderQuote has implemented multiple layers of access controls for administrative roles and privileges. Access to environments that contain Customer Data requires a series of authentication and authorization controls, including Multi-Factor Authentication (MFA). ThunderQuote enforces the principles of least privilege and need-to-know for access to Customer Data, and access to those environments is monitored and logged for security purposes. ThunderQuote has implemented controls to ensure the integrity and confidentiality of administrative credentials and access mechanisms, and enforces full-disk encryption and unique credentials for workstations.

ThunderQuote monitors critical infrastructure for security related events by using a custom implementation of open source and commercial technologies. Activity data such as API calls and operating system level calls are logged to a central point where the information is passed through a series of custom rules designed to identify malicious or unapproved behavior. The results of these rules are fed into an orchestration platform that triggers automated actions, which may include directly alerting the security team or triggering additional authentication requirements.

Privacy Policy

Find out more about our privacy policy and compliance to Singapore’s Personal Data Protection Act (PDPA) here.

Disclosure

If you believe you’ve discovered a bug in ThunderQuote’s security, kindly contact at security@thunderquote.com and we will get back to you within 24 hours or earlier. We request that you not publicly disclose the issue until we have had a chance to address it.