Security

Last updated: July 23, 2023

Our commitment to security

Memetria and Stovepipe Studios make the security of your servers and your data our top priority. Our systems were designed from the ground up to be isolated, secure and reliable, while maintaining the high availability your applications need.

Fully Automated Databases

Memetria allows you to choose between major branches of database software in order to opt-in to new or different database features, but you never need to upgrade or maintain patchlevels yourself.

Memetria's team regularly reviews security advisories and rolls out automated patches to your database and underlying system software without disrupting your application.

Credit Card Safety

Memetria does not store any credit card information from customers. Braintree processes payments and stores all payment information. Braintree is an independent, audited, PCI-compliant service.

Memetria also validates PCI compliance with regular internal audits and scans from a third party.

Privacy

Memetria is committed to the privacy of individuals.

Memetria operates in compliance with the principles of GDPR, LGPD, and other laws and regulatory frameworks designed to safeguard individual privacy. We carefully review and document how data is processed on behalf of our customers.

Memetria complies with the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework, read more about this in our privacy policy.

A Data Processing Addendum (DPA) is included automatically as part of Memetria's Terms of Service. Contact support with any questions about this.

We have a published privacy policy that clearly defines our approach to data privacy, and we take steps to protect the privacy of our customers and their data. You can read more in our privacy policy.

Transport-Layer Security (TLS and SSL)

All Memetria databases support TLS, and can be configured to only accept connections via TLS. Your Memetria account can be configured (in the "Default Settings" menu) to only allow connections via TLS for all resources.

Memetria's roots are kept securely offline. Certificates served up by Memetria databases are signed by an intermediate certificate authority.

Details on configuring TLS connections are integrated into your Memetria dashboard. A copy of our root cert which can be used to verify Memetria connections is available here:

RG Root X1 (self-signed)

Infrastructure Security

Memetria's primary physical infrastructure runs on Amazon Web Services secure data centers. AWS's data centers are accredited by:

ISO 27001
SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II)
PCI Level 1
FISMA Moderate
Sarbanes-Oxley (SOX)

Physical and infrastructure-level security, including access control, power redundancy, fire suppression, climate and temperature control, are all maintained by AWS to the state of the art.

Application Security

Our web dashboard and control plane applications undergo regular vulnerability scanning and source code reviews to assess the security of our systems.

We welcome third party vulnerability reports and take them seriously. Please see "Vulnerability Disclosure" below if you have found something that needs our team's attention.

All web application traffic is restricted to TLS/HTTPS only.

All systems at Memetria have a regular cadence of updates.

Data Security

All communication with your Memetria databases is optionally encrypted, see "Transport-Layer Security" above.

Database backups are encrypted in transit and at rest.

Employee Access

Stovepipe Studios and Memetria employees never access the contents of hosted databases unless required for support reasons. Staff may log into your account to reproduce bugs or problems, and will look at summary reports on the performance of database queries as part of routine monitoring.

When working on support issues we try to respect your privacy and avoid accessing any information stored in your database unless needed to resolve an issue.

All privileged employee devices which may for support reasons need to access customer data use disk-level encryption and regular security update policies.

All Stovepipe Studios employees agree to all company policies as a condition of employment, including our security and privacy policies.

Vulnerability Disclosure

We appreciate help in disclosing any security issues to us in a responsible and ethical manner.

To report a security vulnerability, the Memetria security team can be reached at security@memetria.com. Security is our top priority at Memetria; we will be in touch with you as soon as possible.

You may use the following public key to keep your message safe:

Fingerprint: AF9E AFB3 84A1 06ED 706A  AA09 FC26 CEA2 6687 4692