At Narrative, we believe security is critically important. We are committed to maintaining industry-standard security controls and best practices to protect our systems and the data we handle.
Narrative has been evaluated by a third-party auditor and is SOC 2 compliant. Customers can request a copy of our most recent report here.
Narrative maintains a comprehensive program of security policies and procedures, and management reviews and updates policies annually or as needed.
Narrative performs regular vulnerability scanning and penetration testing of our applications and systems to identify and address any potential security weaknesses. Vulnerabilities are reported, evaluated, tracked, and resolved according to standardized procedures and time requirements.
All customer data is encrypted "At-Rest" using industry-accepted algorithms (e.g., AES-256, RSA-2048) and "In-Transit" using Secure Socket Layer (SSL) or Transport Layer Security (TLS) protocols with a minimum of TLS v1.2. Encryption standards are regularly reviewed and will be updated in accordance with assessed risk and market acceptance of new standards.
Our Software Development Lifecycle policy covers all stages of development and requires — among other things — separation of duties, code review, approval processes, and change control standards.
We continuously monitor our security controls and devices to help us immediately detect and respond to any potential security incidents. We also use an integrated compliance platform to make sure our controls and procedures are properly enforced at all times. Our comprehensive Security & Compliance Report is accessible here.
All employees complete ongoing security training and awareness programs and are required to regularly review and accept our security policies. Engineers are also required to complete additional training, which includes content provided by OWASP.
We implement role-based access controls based on the “least-privilege” principle to ensure employees only have access to systems and applications necessary for their role. Narrative management regularly reviews access and can revoke it as needed. All employees are pre-screened and required to sign confidentiality agreements upon hiring. Multi-factor authentication is required for any and all systems that provide the option.
Independent third-party audits and assessments are performed at least annually to validate the effectiveness of our controls and procedures.
If you believe you've found a security issue in our product or service, we encourage you to notify us so we can take steps to address it as quickly as possible.
Narrative reserves the right to designate any reported vulnerability as out of scope.
Please e-mail your findings to security@narrative.io and include enough information to reproduce the problem. Usually, the IP address or the URL of the affected system and a description of the vulnerability will be sufficient. We will respond to your report within 3 business days with our evaluation of the report and an expected resolution date.
