Rocketlane offers comprehensive Role-Based Access Control (RBAC) with fine-grained permissions across multiple levels to ensure secure and appropriate access management.

1. Account Level Permissions

Control creation of templates, dashboard management, and account-specific actions Govern both the actions users can perform and types of information they can access

2. Project Level Permissions

Users granted access to interact with specific projects Project participation limited to invited users only Adheres to account-level permissions while enabling project-specific authorization

Customer Level Permissions

Dictates interactions customers can have with projects Ensures clients have necessary access without compromising sensitive information

This multi-layered RBAC approach ensures data privacy, appropriate access control, and secure collaboration across all user types and organizational levels.

Rocketalne Protecting customer data is a top priority of Rocketlane Crop. As an overview, the security program for our products includes the following:

1. As default, we encrypt data at rest using the AES 256-GCM algorithm and data in transit using TLS 1.2 and above.
2. We have implemented an integrity monitoring solution and have configured scheduled backups, these backups are stored in an encrypted format at rest and in transit.
3. We conduct external VAPT assessments every six months and internally we conduct VA on a Weekly basis.
4. We have defined standard hardening guidelines in line with AWS CIS benchmarks for all our infrastructure elements.
5. Access control is restricted using role-based access control (RBAC), where roles follow the least privilege model.
6. Account access is reviewed monthly, and access is revoked for all accounts that have been inactive for a continuous period of 45 days.
7. MFA is enforced for all critical systems whether it is remote or not. Authentication may only be performed over secure, encrypted connections.

Rocketlane ensures appropriate procedures are in place to ensure compliance with regulatory requirements related to transfer of personal data.

We use TLS 1.2 and above versions during Tranist and we use AES 256 while in Rest

Rocketlane has set up processes to utilize standard encryption methods, including HTTPS with the TLS algorithm, to keep transmitted data confidential.

We use TLS 1.2 and higher for Transit and We use AES 256 for Rest encryption.

Full-disk encryption has been implemented across the organizations we use AES 256-GCM for encrypting the disks. In the event of a stolen or lost laptop, the data on these devices remain encrypted, preventing the data from falling into the wrong hands.

For the cloud environment, we use Key Manager to manage the keys centrally.

We have enabled multiple layers of email security option to strengthen our email security:

1. Encryption using Transport Layer Security (TLS) for emails in transit.
2. Spam and malware filtering to block suspicious and harmful messages.
3. Two-step verification for an additional layer of security. Data loss prevention (DLP) policies to prevent the sharing of sensitive information.
4. Advanced threat protection with attachment scanning and link analysis.
5. Confidential mode to set expiration dates on emails and control recipient actions.
6. Support for S/MIME and PGP encryption for secure email communication.
7. Implemented DKIM, SPF and DMARC email authentication protocols.

HR security is implemented into our environment and it covers the below process:

It is mandatory for every Rocketlane employee to sign an NDA with the organization as part of the joining formalities. We conduct background checks at the time of joining regarding criminal, financial records verification and previous employment, education verification, and address verification.

Rocketlane has a formal incident management process in place to ensure that only authorized changes are performed on the application.

1. Incident responses are handled appropriately based on the type and severity of the incident, and the risk classification of the data or systems involved.
2. The IT and Security team will determine the criticality of the incident, reporting incident details to other authorities or organizations as necessary.
3. When Rocketlane becomes aware of an incident of unauthorized access to sensitive customer information, we will conduct a reasonable investigation to promptly determine the likelihood that the information has been or will be misused. If it is determined that misuse of customer information has occurred or is reasonably possible, Rocketlane will notify the affected customer(s) within 72 hours of the incident being recorded

internal Audits - Annually

VAPT

Internal - Weekly External (by a third party)- Annually DR Test - Annually DPIA & TIA - Annually

We undergo VAPT once every a year by a third-party cybersecurity vendor. All our critical cloud applications go through VAPT scans. The latest VAPT report can be shared. Vulnerabilities are rated by the third-party vendor conducting VAPT and are rated as Critical, High, Medium, and Low severity. We fix vulnerabilities based on their severity.

We have an in-house Security Team which conducts Security assements on Daily basis and we have integrated SonarQube Cloud for SAST and OWASP-ZAP and Truivy for DAST and we use Data Dog for SCA and log analysis.