Communication Recording Agent Security
This topic provides security details for Communication Recording Agent, including Administration Platform security where applicable, and aims to help system administrators understand data security in the context of the Communication Recording Agent product. This information is split into the following general topics:
Reference | Description |
|---|---|
Understand the security measures, authentication procedures, and protections in place to ensure access to Administration Platform and by extension, Communication Recording Agent is securely authenticated and authorized (for both Uniphore and Uniphore Customer employees) | |
Learn how Communication Recording Agent user access is determined and managed, and understand how Communication Recording Agent enables fine control of a user's privileges inside the system, including what capabilities they have and what data they can access. | |
Review how your data is isolated from other Uniphore customers' data and the prevention processes in place to avoid unauthorized data access between tenants. | |
Understand the basics of Uniphore's High Availability and Disaster Recovery (and find links to more comprehensive documents on those subjects), learn how your data storage is managed and kept secure (secret management, data protection, data loss prevention, and encryption). | |
Understand the various protections in place to prevent unauthorized data access. | |
Review who has access to Servers and Data Stores and learn about the systems in place to keep this access secure. | |
Understand how Communication Recording Agent and Administration Platform systems are monitored, and review incident response procedures. |
For more security information, see Additional Security Information, or check out our Information Security site here.
Security - FAQs
The following answers common security questions for Communication Recording Agent and provides links to further reading on each subject.
Q: How does Uniphore authenticate and authorize user access?
A: Uniphore uses Auth0 by Okta for authentication with Multi-Factor Authentication (MFA) and Single Sign-On (SSO). Access is controlled through JWT tokens that contain user identities, roles, and permissions, validated centrally by the API Gateway. All employee access uses Azure AD with MFA and strict access policies. For more information, see Authentication and Authorization.
Q: How is customer data kept separate from other customers' data?
A: Uniphore implements strict tenant data isolation through multi-layer security. Each tenant's data is stored separately, access is controlled by JWT tokens containing tenant-specific information, and the platform uses rigorous data handling policies with continuous monitoring to prevent unauthorized access between tenants. For more information, see Tenant Data Isolation.
Q: How are secrets like API keys and credentials protected?
A: All secrets (API keys, credentials, certificates) are stored in AWS Secrets Manager, an encrypted vault. Only programmatic access is available to microservices - humans, including Uniphore employees, cannot directly access these secrets. This centralized, automated approach reduces the risk of exposure and credential compromise. For more information, see Data Management, Security, and Encryption.
Q: What certifications and compliance standards does Uniphore meet?
A: Uniphore holds ISO/IEC 27001:2013, PCI DSS Level 1, and SOC2 Type II certifications. The company also adheres to the GDPR (EU data protection) and HIPAA (healthcare data) standards, with regular third-party audits to ensure ongoing compliance. For more information, see Additional Security Information.
Q: How is data encrypted and protected in storage?
A: Data is encrypted at rest using AWS encryption services. Collectors use disk encryption for local storage. When data is purged, AWS delete mechanisms securely destroy the encrypted data. The system enforces encryption end-to-end with strict access controls through the API Gateway. For more information, see Data Management, Security, and Encryption.
Q: What security testing does Uniphore perform?
A: Uniphore conducts Static Application Security Testing (SAST) with every code commit, Dynamic Application Security Testing (DAST) in runtime, quarterly internal and external Vulnerability Assessments, semiannual third-party VA/Penetration Testing, and regular Manual Penetration Testing. For more information, see Additional Security Information.
Q: How does Uniphore monitor and control access to production systems?
A: All production access is routed through Teleport, which enforces zero-trust authentication and role-based access control. Access is limited to authorized Cloud Operations and SRE team members only. All sessions are recorded and audited in real-time for full traceability and accountability. For more information, see Access Control - Servers and Data Stores.