Detailed security measures
Learn about the technical, organizational, and administrative measures we’ve implemented to protect the security and confidentiality of the data entrusted to Psylio.
Infrastructure and hosting
Data hosting
Psylio data is hosted on Amazon Web Services (AWS) in Montreal (Canada).
Data encryption
All data is encrypted both at rest and in transit.
- At rest: Encryption using industry-standard algorithms, including AES-256
- In transit: Data protected using TLS/SSL protocols
Platform security
Vulnerability management
We use multiple mechanisms to identify, assess, and remediate vulnerabilities throughout the software development and operational lifecycle.
These measures include:
- Quality assurance processes
- Automated vulnerability scanning
- Continuous infrastructure monitoring using services such as AWS Security Hub, AWS Detective, and AWS GuardDuty
Security testing
Security testing is performed regularly to identify known vulnerabilities and maintain a high level of protection.
These assessments include:
- Automated penetration testing
- SSL certificate analysis
- Server configuration reviews
- Detection of outdated technologies
- Testing for key vulnerabilities identified by OWASP
Intrusion protection
Psylio's web applications are protected by AWS Web Application Firewall (WAF).
This protection helps prevent:
- Attacks targeting web applications
- Attempts to exploit known vulnerabilities
- Malicious bots
- Requests that could compromise the platform's availability or security
Logging and monitoring
System logs and security events are continuously monitored to detect anomalies and service interruptions as quickly as possible.
Continuity
Backups and recovery
Backups are performed automatically using AWS Backup services. They enable data and services to be restored in the event of hardware failure or a major incident.
Incident management
Security incidents are assessed based on their level of severity.
Our procedures include:
- Incident analysis and classification
- Escalation procedures
- Mitigation measures
- Communication with affected individuals or organizations
Access management
Access control
Access to our cloud infrastructure and other sensitive systems is restricted to authorized personnel based on their job responsibilities.
These measures include:
- Multi-factor authentication (MFA)
- Single sign-on (SSO)
- Strong password policies
- Role-based access control
Principle of least privilege
We apply the principle of least privilege to ensure that each team member has access only to the resources necessary to perform their responsibilities.
Privacy protection
Confidentiality
All team members sign a confidentiality agreement before beginning their employment and are required to comply with it throughout their employment.
Background checks
Background checks are conducted for all team members in accordance with applicable laws.
Privacy officer
In accordance with applicable requirements, a designated Privacy Officer oversees the implementation of our privacy practices.
Optania Éducation Inc.284, rue de l’Hôtel-de-Ville
Saguenay (Québec) G7H 1R7
Canada
prp@optania.com
Third-party providers
Psylio works with a limited number of specialized service providers to support the delivery, security, and continuous improvement of its services.
These providers may process certain information on our behalf only to the extent necessary to deliver the services entrusted to them. We select our providers based on their ability to meet our requirements for confidentiality, privacy protection, and security.
These lists are updated as needed to reflect changes to our services.
Providers used by Psylio
| Provider | Purpose | Categories of data processed |
|---|---|---|
| Amazon Web Services (AWS) | Hosts our infrastructure, data, and documents. | Application data, user-uploaded files, and product-related events. |
| Bugsnag | Monitors application errors and exceptions. | Error logs and technical events related to platform usage. |
| CookieYes | Manages cookie consent. | Cookie consent preferences. |
| Google Analytics | Analyzes platform usage to improve the user experience. | Usage data and navigation events. |
| Google reCAPTCHA | Protects against automated bots, abuse, and fraudulent activity. | Information required to evaluate requests and assign a trust score. |
| Laravel Nightwatch | Monitors application performance and errors. Published by Laravel Holdings Inc. | Technical logs and events related to platform operation. |
| Oh Dear | Monitors service availability and health. | Platform operational status data. |
| Postmark | Sends transactional emails. | Email address, name, and information required to deliver communications. |
| Stripe | Processes online payments securely. | Billing information, customer information, payment method details, and information required to process transactions. |
| Zoho Desk | Manages support requests. | Email address, support request content, and information voluntarily provided during interactions with our support team. |
Providers used to support our business operations
| Provider | Purpose | Categories of data processed |
|---|---|---|
| Google Workspace | Provides internal communication and collaboration tools, including email, documents, and spreadsheets. | Emails, internal documents, and personal information that may be included in communications with users or customers. |
| Slack | Supports internal communication and collaboration among team members. | Information required to review and process support requests, including email addresses and communication content. |
| Linear | Supports internal project management and product development. | Information related to work organization and, when necessary, information required to manage a request or project. |
| Zoho CRM | Manages customer relationships. | Contact information, organization details, communication history, and information required to manage communications and services. |
| HubSpot | Manages relationships and communications with customers and prospective customers. | Contact information for customers and prospective customers, organization details, communication history, and information required to manage communications and services. |
Need more information?
If you have any questions about our security or privacy practices, please feel free to contact us.