Since our founding in 1993, thousands of CasaManager users have trusted sensitive data of their children to our system. Our team has worked very hard to ensure this data is safely stored and securely transmitted while in normal use.
For purposes of brevity, the term Our Solutions will refer to CasaManager, CasaConnect, MentorManager and VisitManager and any other solution we publish.
- Authentication: Each agency is deployed its own database. For each agency, user accounts have unique usernames and passwords that must be entered each time a user logs on. Users are defined by each agency within their database.
- Passwords: User passwords have minimum complexity requirements. Passwords are individually salted and hashed.
- Single Sign-On: Our Solutions are not currently configured to support Single Sign-On.
- Data Encryption: Certain sensitive user data, such as account passwords, are stored in encrypted format.
- Data Portability: Based on a user’s permission set, Our Solutions enable users to export their data in a variety of formats to be used with other applications.
- Data Residency: Our Solutions are stored on servers located in the United States.
Our cmCloud servers are hosted in world-class data centers provided by Amazon Web Services and Vultr. These data centers include all the necessary physical security controls you would expect in a data center these days (e.g., 24×7 monitoring, cameras, visitor logs, entry requirements).
- Uptime: Continuous uptime monitoring, with immediate escalation to CasaManager staff for any downtime.
- Backup Frequency: Backups occur daily and may be restored if necessary.
- Backup Retention: AWS-based cmCloud servers are configured to retain 30 days of backups and once weekly for a year. Vultr-based cmCloud servers are configured to retain 7 days of backups.
- Firewalls: Firewalls restrict access to all ports except 80 (http), 443 (https), and 5003 (FileMaker Pro).
- Access Control: Role-based access is enforced for systems management by authorized engineering staff.
- Encryption in Transit: By default, Our Solutions hosted on our cmCloud servers, utilize Transport Layer Security (TLS) to encrypt traffic.
- Patching: Latest security patches are applied to all operating systems, applications, and network infrastructure to mitigate exposure to vulnerabilities.
Organizational & Administrative Security
- Information Security Policies: We maintain internal information security policies, including incident response plans, and regularly review and update them.
- Service Providers: We screen our service providers and bind them under contract to appropriate confidentiality and security obligations if they deal with any user data.
- Access: Access controls to sensitive data in our databases, systems, and environments are set on a need-to-know / least privilege necessary basis.
Software Development Practices
- Stack: We code in FileMaker Pro, PHP and mySQL and run on FileMaker Server, Macintosh, Windows, and Ubuntu.
- Coding Practices: Our engineers use best practices and industry-standard secure coding guidelines.
- Deployment: Development is conducted in a separate environment and deployed to production as needed. We notify our clients in advance of deploying any major update.
Handling of Security Breaches
Despite best efforts, no method of transmission over the Internet and no method of electronic storage is perfectly secure. We cannot guarantee absolute security. However, if CasaManager learns of a security breach, we will notify affected users so that they can take appropriate protective steps.
Keeping your data secure also depends on you ensuring that you maintain the security of your account by using sufficiently complicated passwords and storing them safely.
Last updated: October 26, 2017.