InVerify is keenly aware of the need for both Data Security and Data Privacy. Data privacy goes beyond the traditional IT data security and addresses issues such as corporate culture, data collection policies, and data quality initiatives. Data privacy professionals define privacy as the right of an individual to control information about him or herself. Our enhanced Income Key management capabilities allow your employees to manage access to their data.
Key Elements of our Data Privacy Principles
- Openness: We have a general willingness to share our personal data practices and policies with customers and regulators.
- Participation: An individual has the ability to obtain data related to him or her in a timely and low-cost manner, and to correct errors in the data.
- Use Limitation: Personal data is not used for purposes other than those specified by InVerify in conjunction with the employer at the time the data was collected.
- Data quality: Personal data is accurate, complete, relevant to the employers and employees needs, and audited regularly for updates.
- Data Limits: There are limits on the amount and type of personal data we collect, that data shall be directly relevant to the services provided.
- Security: Personal data is protected against the risk of loss or unauthorized access, destruction, use, or modification.
Key Elements of our Data Security Approach
The following Data Security Plan outlines many of the steps we take to ensure our customer’s data is both secure and confidential.
- InVerify does not expose any client data to e-mail or our staffs PCs/Laptops. Our data collection procedures are through our online secure FTP site.
- Our system administrators and Customer Service representatives must login to a secure network prior to accessing the InVerify application. All usernames and password entries onto our FTP site and onto the online InVerify application are encrypted using SSL (secure socket layer) certificates.
- Key fields in the InVerify SQL Server 2008 database are encrypted as well. These fields include SSN, Home Address, & Salary.
- The InVerify system is hosted at a Tier 1 data center facility. We ensure the facilities we use are SAS 70 Type II certified, located in unmarked facilities, utilize biometrics, provide video surveillance monitoring at all access points, execute restricted keycard access and deploy three layers of network monitoring all to provide our customers with the highest levels of security.
- All of the InVerify web servers utilize a digital certificate issued by VeriSign. VeriSign is one of the leading Internet Infrastructure service providers and enables secure e-commerce, websites, intranets and extranets through the use of Secure Socket Layer (SSL) certificates for two-way encryption. All communications to our website occur over HTTPS protocol. No request made to the InVerify system can be made over the unsecured HTTP.
- If hard copy documents must be created they are discarded in a secure, locked document destruction container. All documents in the container are destroyed by an outside, bonded and insured document destruction company.
- As a result of working with sensitive information, all InVerify employees are required to go through background screening prior to joining our company, including drug screening and criminal background checks.
- All data files exchanged with customers are secured with PGP encryption technology.
- All Social Security numbers (SSN) are masked on customer reports.
- All employees are required to sign confidentiality agreements upon hire at InVerify, informing them of their role and securing their signed acknowledgement of the confidentiality requirement.
- General office access is restricted during business hours by a numeric, key code lock.