Security & Privacy
We take our responsibility to help protect your data and environments which starts with protecting our own.
Building Security is one thing — providing it is another.
Mission's security and compliance posture is governed by a custom Mission Information Security Management System (ISMS). This ISMS is developed by looking at external compliance regimes (SOC2, ISO, etc.), best practices from organizations like SANS and AWS, and internal Mission requirements.
Mission systems and personnel are expected to abide by the requirements in the ISMS and its sub-policies and procedures. This activity is then mapped to external compliance regimes to provide evidence for our auditors. Mission currently audits against SOC2 and ISO27001 on an annual basis. In addition to these regimes, we are able to map our ISMS to many other regimes or requirements at customer request.
Access to your AWS Environment
Many Mission products and services require that customers provide some form of access to customer-controlled AWS accounts to Mission personnel. This access is protected using native AWS security tools like Identity and Access Management (IAM).
Any access to customer infrastructure starts with the Mission resource authenticating to Mission’s IAM tooling (currently Okta) which requires Multi-Factor Authentication (MFA). Note that only roles that require customer access are allowed to authenticate following a least privilege model and all authentications on the Mission side are logged and audited.
Once authentication is complete, the Mission resources may access the customer environment in a variety of ways.
Mission differs from many of your SaaS partners in that our job is to help manage your AWS environment. Your data will stay in your AWS accounts with full access to your team and under your control. Mission does not collect, process or store any data that you have in your AWS account.
Mission does collect data about the team we will interface with — primarily contact information like names, emails and phone numbers. We also collect data that we need for billing — this includes the usage generated in your AWS environment. Data that Mission collects is protected both in transit (using common protections like TLS) and at rest using standard AWS encryption techniques.
Mission Cloud is capable of assisting customers with a wide range of security needs. You can visit our Mission Cloud One product page for more information. This section details Mission’s approach to security for our internal systems.
Report A Security Problem
Mission believes that working with skilled security researchers can identify weaknesses in any technology. If you believe you’ve found a security vulnerability in Vanta’s service, please notify us; we will work with you to resolve the issue promptly.
Mission Cloud is providing this service to help ensure a safe and secure environment for all of its users. As such, any users believed to be engaging in the below activities will have their user credentials immediately deactivated.
While researching, we’d like you to refrain from:
- Denial-of-Service (DoS)
- Social engineering or phishing of Mission Cloud’s employees, customers, or contractors
- This policy applies to the Mission Cloud Application hosted at control.missioncloud.com and to any other subdomains or services associated with the Mission CloudApp.
- Thank you for helping to keep Mission Cloud and our customers safe!
Have any feedback, questions, or suggestions?
Mission Cloud is always open to feedback, questions, and suggestions. If you would like to talk to us, please feel free to email us.