# Security Last updated on March 5, 2025 ## Organizational security ### Compliance documents Visit your dashboard documents page to find detailed security information and downloadable compliance reports, including SOC 2 Type II and HIPAA. [Go to documents](/content/dashboard/documents/index.html) ### Information security program We have an information security program in place that is communicated throughout the organization. Our information security program follows the criteria set forth by the SOC 2 framework. SOC 2 is a widely known information security auditing procedure created by the American Institute of Certified Public Accountants. ### SOC 2 certified Liveblocks is SOC 2 Type II compliant. Access to the SOC 2 report requires a Team plan. If you would like to see a copy of our report, please visit your [dashboard documents page](/content/dashboard/documents/index.html). ### HIPAA compliance Liveblocks supports HIPAA compliance for enterprise customers. Access to HIPAA documentation requires the team plan with the HIPAA add-on. If you would like to see a copy of our report, please visit your [dashboard documents page](/content/dashboard/documents/index.html). ### Third-party audits Our organization undergoes independent third-party assessments to test our security and compliance controls. ### Third-party penetration testing We perform an independent third-party penetration at least annually to ensure that the security posture of our services is uncompromised. ### Roles and responsibilities Roles and responsibilities related to our information security program and the protection of our customer's data are well-defined and documented. Our team members are required to review and accept all of the security policies. ### Security awareness training Our team members are required to go through employee security awareness training covering industry standard practices and information security topics such as phishing and password management. ### Confidentiality All team members are required to sign and adhere to an industry standard confidentiality agreement prior to their first day of work. ### Background checks We perform background checks on all new team members in accordance with local laws. * * * ## Cloud security ### Cloud infrastructure security All of our services are hosted with [Amazon Web Services (AWS)](https://aws.amazon.com/) and [Cloudflare](https://www.cloudflare.com/). They employ a robust security program with multiple certifications. For more information on our provider's security processes, please visit [AWS Security](https://aws.amazon.com/security/) and [Cloudflare Security](https://www.cloudflare.com/trust-hub/abuse-approach/). ### Data hosting security All of our data is hosted on [Amazon Web Services (AWS)](https://aws.amazon.com/), [MongoDB Atlas](https://www.mongodb.com/atlas/database) and [Cloudflare](https://www.cloudflare.com/) databases. These databases are distributed around the world. Please reference the above vendor specific documentation linked above for more information. ### Encryption at rest All databases are encrypted at rest. ### Encryption in transit Our applications encrypt in transit with TLS/SSL only. ### Vulnerability scanning We perform vulnerability scanning and actively monitor for threats. ### Logging and monitoring We actively monitor and log various cloud services. ### Business continuity and disaster recovery We use our data hosting provider's backup services to reduce any risk of data loss in the event of a hardware failure. We utilize monitoring services to alert the team in the event of any failures affecting users. ### Incident response We have a process for handling information security events which includes escalation procedures, rapid mitigation and communication. * * * ## Access security ### Permissions and authentication Access to cloud infrastructure and other sensitive tools are limited to authorized employees who require it for their role. Where available we have single sign-on (SSO), 2-factor authentication (2FA) and strong password policies to ensure access to cloud services are protected. ### Least privilege access control We follow the principle of least privilege with respect to identity and access management. ### Quarterly access reviews We perform quarterly access reviews of all team members with access to sensitive systems. ### Password requirements All team members are required to adhere to a minimum set of password requirements and complexity for access. ### Password managers All company issued laptops utilize a password manager for team members to manage passwords and maintain password complexity. * * * ## Vendor and risk management ### Annual risk assessments We undergo at least annual risk assessments to identify any potential threats, including considerations for fraud. ### Vendor risk management Vendor risk is determined and the appropriate vendor reviews are performed prior to authorizing a new vendor. * * * ## Contact us If you have any questions, comments or concerns or if you wish to report a potential security issue, please contact [security@liveblocks.io](mailto:security@liveblocks.io).