EXP understands that the confidentiality, integrity, and availability of our customers’ information are vital to their business operations and our own success. We use a multi-layered approach to protect that key information, constantly monitoring and improving our application, systems, and processes to meet the growing demands and challenges of security.

Data Centers

EXP's production SaaS environment is hosted within a Private Secure Cloud infrastructure in professionally managed data center facilities. EXP manages its application, server, database, and applicable network and security configurations, while the hosting provider operates the underlying physical data center, virtualization, storage, and related infrastructure.

Compliance and Assurance

• The underlying hosting environment is subject to independent third-party security and compliance assessments.
• The hosting provider maintains ISO 27001:2022 and ISO 27701:2019 certifications covering applicable information security and privacy management controls.
• The hosting environment is also subject to independent SOC 2 Type 2 examinations covering Security, Availability, Confidentiality, and Privacy.
• EXP maintains its own cybersecurity policies, controls, monitoring, vulnerability management, and compliance processes in addition to the controls provided by the hosting environment.

Access Control and Physical Security

• Physical access to data center facilities and information-processing infrastructure is restricted to authorized personnel.
• Data center access is controlled, monitored, and logged.
• Physical security controls protect infrastructure from unauthorized access and environmental threats.
• EXP personnel do not require routine physical access to the underlying data center infrastructure.

Network Security

• EXP's production environment is protected by dedicated firewall and network security controls.
• Network access follows a default-deny approach, with only required services and authorized traffic permitted.
• Administrative access to protected server environments is restricted to authorized personnel through secure network access controls.
• Development, testing, and production environments are logically segregated.
• Network and security events are logged and monitored for suspicious or unauthorized activity.
• Firewall and network security configurations are periodically reviewed.

Infrastructure and Data Protection

• Customer data is protected through layered security controls at the application, operating system, network, virtualization, and storage levels.
• Production storage and backups are encrypted at rest using industry-standard encryption.
• Data transmitted to and from EXP applications is protected using current industry-standard TLS encryption.
• Role-based access controls and least-privilege principles are applied to administrative access.
• Infrastructure, operating systems, databases, and applications are subject to vulnerability management, security patching, and configuration management processes.

Availability and Resilience

• The underlying data center infrastructure incorporates redundant power, cooling, network, and storage capabilities designed to support service availability.
• EXP maintains encrypted backups and documented business continuity and disaster recovery procedures.
• Backup and recovery processes are periodically tested to verify recoverability and data integrity.

Applications & Data Security

EXP security teams are dedicated to ensuring your applications and data stay secure and available.

Application Environments

• 3-Tier application environment.
• Environments are only accessible via VPN firewall.
• Strong internal controls and policies dictate access to environments.
• Customers have the option of shared or dedicated environments.
• Security patches are regularly applied to operating system, database and other server applications.

Authentication Security

• EXP Direct Authentication:
• Authentication direct to EXP applications uses forms authentication to SQL Server and ASP.Net SQLMembershipProvider.
• Customer Provided Authentication:
• AD/LDAP/ADFS options available.
• Windows Authentication options available.
• HTTPS & SSL Security with Industry Standard Policies.

Application Connectivity

• Connections to EXP applications are secured using HTTPS with current industry-standard TLS encryption. Deprecated SSL protocols, including SSL 3.0, are not supported for application connectivity. TLS certificates are currently issued through Let’s Encrypt, a widely trusted public Certificate Authority supported by major technology platforms and root programs, including Microsoft, Google, Apple, and Mozilla.
• Individual user sessions are identified and re-verified with each transaction, using a CSRF token created on each form.
• IP filtering can be enabled to ensure denial of access.

Backups

• Backups are encrypted.
• Frequency – Daily / every 24 hours.
• Retention – Daily backup for 7 days, Weekly backup for 4 weeks and Monthly backup for 6 months.

Disaster Recovery

• 48 hour recovery after complete failure (maximum allowable downtime).
• Disaster recovery tests verify our projected recovery times and the integrity of the customer data.

Governance and Security Management

Security Management

• EXP maintains an extensive set of internal controls and procedures to ensure compliance and operate in a proactive nature.

Application Vulnerability Threat Assessments

• Network vulnerability threat assessments.
• Penetration testing and code review.
• Security control framework review and testing.

Security Monitoring

• EXP monitors notifications from various sources and alerts from internal systems to identify and manage threats.

Testing and Control

• EXP conducts regular code reviews to ensure proper security standards are followed and to help prevent vulnerabilities such as XSS, CSRF spoofing, and SQL injection. Exception management in production environments is handled securely, including protection of sensitive technical details such as stack traces, SQL statement fragments, table names, and database names.

Data Protection and Privacy

• Where applicable, EXP supports customer data protection requirements through a Data Processing Agreement (DPA). The DPA documents EXP’s commitments regarding the processing, safeguarding, retention, return, and deletion of Customer Data, as well as applicable sub-processor and privacy obligations.

Security Vulnerability Reporting

EXP encourages customers, security researchers, and other third parties to responsibly report suspected security vulnerabilities affecting EXP applications, systems, or services.

Security vulnerabilities may be reported to security@exp-inc.com. Please include sufficient information to help us understand and reproduce the issue, including the affected application or service, a description of the vulnerability, steps to reproduce where applicable, and relevant supporting information.

Security reports are reviewed and triaged by appropriate EXP technical and security personnel. Confirmed vulnerabilities are evaluated based on risk and addressed through EXP's vulnerability management and remediation processes.

Please do not access, modify, download, or disclose customer or other third-party data when investigating or reporting a suspected vulnerability.