Standard
ISO/IEC 27001
Information security management
The framework for how we identify risks, apply controls and keep improving the way information is protected across the company.
Security & compliance
Built for businesses that take security seriously.
Comark is certified to ISO/IEC 27001, 27018 and 27019. This page explains what that means in practice: how we protect the systems we build, host and operate, and where your team's responsibilities begin.
Standards we work to
Details below
- ISO/IEC 27001Information security management
- ISO/IEC 27018Personal data in the cloud
- ISO/IEC 27019Controls for the energy utility sector
Certified
The standards
Three standards, one way of working.
What each standard covers and where you will see it in our work. Certificate details are shared with customers as part of a security review.
Ask for certificate details01 / 03 · swipe
Security practices
What we do, day to day.
Seven areas that apply to every system we build or operate. Schedules, retention and data location are confirmed per service agreement.
Encrypted communication
Traffic between users, our servers and third-party services is encrypted in transit with TLS, and certificates are renewed before they expire.
- HTTPS on every site and API
- Certificates renewed automatically
- Certificate expiry monitored
Secure infrastructure
Servers are hardened before they go live and kept patched afterwards. Only the services a system needs are exposed.
- Hardened Linux setup with SSH keys
- Operating system and security patches
- Firewall and access rules
Backups
Backups run on a schedule and are stored off-site. We restore them regularly: a backup that has never been restored is an assumption.
- Scheduled off-site backups
- Regular restore tests
- Schedule and retention set per system
Access controls
People get the access their role needs and no more. Administrative sign-in is protected with a second factor.
- Role-based permissions
- Two-factor sign-in for admin access
- Audit log of changes
Monitoring
Servers, applications and security events are monitored, with alerts going to engineers who know the system.
- Uptime and resource alerts
- Security event alerts
- Alerts handled by the team that built it
Data protection
Personal data is handled according to privacy requirements and our ISO/IEC 27018 practices, and stored where we agree with you.
- Encrypted in transit
- Access limited by role
- Data location agreed in writing
Secure development
Security is part of how we write code: dependencies are kept current, and every change is tested on staging before it reaches production.
- Staging before production
- Dependency and security updates
- Functional, performance and security checks before launch
Encrypted communication
Traffic between users, our servers and third-party services is encrypted in transit with TLS, and certificates are renewed before they expire.
- HTTPS on every site and API
- Certificates renewed automatically
- Certificate expiry monitored
Secure infrastructure
Servers are hardened before they go live and kept patched afterwards. Only the services a system needs are exposed.
- Hardened Linux setup with SSH keys
- Operating system and security patches
- Firewall and access rules
Backups
Backups run on a schedule and are stored off-site. We restore them regularly: a backup that has never been restored is an assumption.
- Scheduled off-site backups
- Regular restore tests
- Schedule and retention set per system
Access controls
People get the access their role needs and no more. Administrative sign-in is protected with a second factor.
- Role-based permissions
- Two-factor sign-in for admin access
- Audit log of changes
Monitoring
Servers, applications and security events are monitored, with alerts going to engineers who know the system.
- Uptime and resource alerts
- Security event alerts
- Alerts handled by the team that built it
Data protection
Personal data is handled according to privacy requirements and our ISO/IEC 27018 practices, and stored where we agree with you.
- Encrypted in transit
- Access limited by role
- Data location agreed in writing
Secure development
Security is part of how we write code: dependencies are kept current, and every change is tested on staging before it reaches production.
- Staging before production
- Dependency and security updates
- Functional, performance and security checks before launch
Engage
In our own product.
Engage, our messaging platform, is built, hosted and run by Comark. These protections are part of it.
About Engage- Row-level security on every table
- Channel tokens kept in an AES-256-GCM vault
- HMAC-verified webhooks
- Retention windows for stored data
- An audit trail of contact consent
Shared responsibility
Security is a partnership. Here is where the line sits.
The exact split depends on the service and is written into each agreement. This is the typical arrangement for a system we manage.
What we handle
Comark- Server hardening and OS patching
- Firewalls, TLS and certificate renewal
- Backups, restore tests and recovery
- Monitoring and alerting
- Secure code and dependency updates
- Access for our own staff
- Incident response on our systems
What we agree together
In the agreement- Roles and permission model
- Backup schedule and retention
- Data location and processors
- Recovery objectives
- Third-party integrations
- Incident contacts and escalation
What your team handles
You- User accounts and who gets access
- Strong passwords and two-factor sign-in for your users
- Removing access when people leave
- Content and data you upload
- Devices used to access the system
- Reporting anything suspicious to us
Responsible disclosure
Report a vulnerability to us first.
If you believe you've found a security issue in a Comark system or in Engage, please report it privately by email. We'll acknowledge it and keep you informed while we fix it.
Report toinfo@comark.co.il
When you report
- 01Describe the issue and the steps to reproduce it
- 02Don't access, change or delete other people's data
- 03Give us time to fix it before sharing publicly
For your security review
Ask the engineers.
We answer security reviews directly. Tell us what your process needs.
Security reviews, answered by engineers.
Send us your questionnaire or requirements. An engineer, not a salesperson, will answer them.