Access Control

Our cloud services are securely hosted on Amazon Web Services (AWS). Specifically, ProtoPie Enterprise Cloud is hosted within a private section of AWS data centers. ProtoPie Enterprise On-Premises is the only ProtoPie solution that is self-hosted on a physical server within the customer's organization.

This page provides information about our access control policies and procedures for ProtoPie Enterprise Cloud environments, including user account management, authentication, and authorization protocols.

Authentication

Our ProtoPie Enterprise Cloud solution is managed by two administrators within our company. Administrators are assigned a unique user ID and password. There are no other methods of accessing data.

We use robust Security Token Services (STS), with multifactor authentication (MFA) for all accounts, regardless of their permission levels.

Passwords expire every 90 days and must be:

• at least 8 characters long
• contain at least one uppercase letter (A-Z)
• contain at least one lowercase letter (a-z)
• contain at least one non-alphanumeric character (! @ # $ % ^ & * ( ) _ + - = { } | ')

Accounts can modify their password, but the system remembers the 10 most recent passwords for each user and prevents reuse.
Passwords are encrypted when stored or transferred within the system to protect them from unauthorized disclosure and modification.

We allow up to five unsuccessful login attempts, but users who are locked out can request administrators to unlock their accounts at all times.

Concurrent logins are allowed to enable connections across devices within ProtoPie.

Session Management

We employ unique on-time session keys generated by JSON Web Tokens (JWT) based on the user's identity assurance.

These session keys remain valid for a period of 180 days. They are encrypted and securely stored within the user's browser. Once issued by the server, these keys are stored in the cache area of each client browser, ensuring secure session management.

Authorization

We ensure data security through the implementation of two key policies: separation of duties and the least privilege access.

To manage access control effectively, we rely on AWS Identity and Access Management (IAM), which enables role-based access control (RBAC) within our solution.

Identity & Access Management

Our Identity & Access Management process follows a formal and structured approach, comprising the following steps:

1. User ID request: users initiate the process by submitting a request through the designated User ID request form.
2. Department head review: the request undergoes thorough review by the respective department head.
3. Security officer approval: the security officer carefully evaluates the request and grants approval based on established security guidelines.
4. Account creation: Upon approval, the system administrator creates the account, ensuring a smooth onboarding process.

Identity & access management reviews are conducted on a monthly basis and also take place whenever there is a change in responsibility, or when an account departs from the company.

Remote Access

While we cannot provide a comprehensive list of accounts with authorized server access, the information can be verified using the ID management console.

Access to the enterprise environment is exclusively granted by the administrators in our Enterprise Operations division. In cases where product engineers require temporary access for troubleshooting purposes, permissions can be granted and subsequently revoked once the troubleshooting is completed.

We provide secure remote access to servers through AWS SSM (Session Manager). Access to EC2 instances is restricted to administrators within our Enterprise Operations division.

To access an EC2 instance, administrators log into the AWS management console with Multi-Factor Authentication (MFA) enabled, via SSH. All communications are encrypted using TLS 1.2.

We capture detailed logs that include information such as:

• Who accessed a specific EC2 instance and the timestamp of access.
• Who worked on a particular EC2 instance and the corresponding timestamp.

These logs are periodically reviewed through CloudTrail, ensuring transparency.

Network connections associated with communication sessions are automatically terminated after a maximum of 30 minutes of inactivity.

To safeguard the integrity of our remote access system, administrators are not authorized to connect from smart devices such as iPads, smartphones, or PDAs.

Onboarding and Offboarding

To ensure the integrity of our workforce, our HR division follows a thorough onboarding process for new employees. This includes conducting reference checks with their former coworkers and supervisors to verify their experience and educational background. However, they are unable to inquire about credit or criminal history.

In South Korea, where our company is based, conducting background screening checks can be a challenging task due to various reasons. One significant factor is the country's prohibition of using police records for criminal history checks. Moreover, data protection laws require additional consent from individuals to release such personal information. As an organization, we prioritize compliance with these rules and regulations to avoid any legal consequences.

When an employee departs from our company, our HR division promptly informs the security team of their last working day. On that designated date, the employee's account is deactivated, ensuring they no longer have access to our systems and data. Unless otherwise requested, their account will be permanently deleted after a period of two weeks.