Security is a top priority at Blink and we live it in our day-to-day activities. We’ve built a comprehensive security program that is in line with Cyber Essentials and National Cyber Security Centre (NCSC) Cloud Security Principles. Our Senior Management team is accountable for security and ensure that security capabilities and competence exist in all levels of our business.
As a whole, we follow a holistic and collaborative approach to guarantee the confidentiality, availability, and integrity of your data. On this page, you can read about the various policies and security measures taken by Blink to secure user content and data hosted on our platform from unauthorized access.
Our infrastructure runs purely on Amazon Web Services (AWS), which delivers infrastructure as a service with prime security capabilities.
The data centres used for storing your content and allowing it to be delivered to your users are certified for compliance with the ISO 27001 standard. This standard details requirements for an information security management system (ISMS) within an organization, that is AWS, to ensure they systematically evaluate risks, threats and vulnerabilities to their information security, and having controls and a management process to constantly manage risk and meet security needs. To provide unbiased neutrality, certification is carried out by independent third-party auditors.
Your data is encrypted at rest in AWS S3 buckets, AWS RDS instances and block devices used by AWS EC2 instances. AES-256 encryption is used by default via AWS’ encryption services, while key management is handled by AWS KMS. This ensures the content is preserved and safe from prying eyes and manipulation.
All user passwords are hashed using the Bcrypt password hashing function and stored in the database. Bcrypt uses salts and 10 rounds of an algorithm to increase the complexity of hashing to minimize the risk of passwords being cracked. **
All communication between you, your services and Blink, that includes your data, traverses the Internet via encrypted HTTPS traffic using TLS. This encryption during communication ensures information cannot be read or manipulated by unauthorized third parties.
Our infrastructure, web applications, and APIs are penetration tested annually by external independent parties. Any vulnerability found are fixed based our specifications in an internal SLA.
All our data, including S3 buckets and database daily backups, is replicated between multiple regions thanks to the use of AWS. Backup data is encrypted at rest using AES-256 encryption with keys provided by AWS KMS.
Physical security to our servers and to your data is managed by AWS security certifications. Physical security at our offices is also governed by our security program.
Networking in the cloud is very different from the standard data centre. All communications to and from our servers are controlled by tight security groups an AWS security feature for stateful firewalling.
Your data lives in our servers for as long as you need them. Our Data Retention Policy and Data Classification Policy govern the way we manage data that needs deletion and retirement.
To prevent brute force attacks against our APIs we implement rate limits on all API calls, including lower limits for authentication requests.
Our infrastructure runs in Amazon Web Services, where all components are deployed in at least three availability zones, minimizing disruptions caused by any failure and keeping your content constantly available. Elastic Load Balancers are used to automatically split the load and segregate traffic from the Internet to all nodes of our frontend layer.
Our platform has been designed from scratch to support high volumes of web traffic and this technology stack is the fundamental piece that caters to our high availability needs. We utilise varies AWS tools to achieve this high level of availability.
Our APIs and web application are protected in multiple ways against denial of service attacks. AWS provides volumetric denial of service protection through AWS Shield and Elastic Load Balancing to ensure high availability. Our security CDN performs application-layer denial of service protection alongside web application firewall protection.
Blink utilizes database replication architectures to ensure redundancy and uptime. Encrypted backups are made frequently and stored both onsite at the data centre and copied to a remote storage location. Each key service layer has redundant components, such as multiple servers that provide the same service and content, to ensure any failures do not impact the rest of the system. Data centres are also equipped with controls to enforce physical security and protection against environmental hazards.
Once a vulnerability is detected, it is assigned a score, using the CVSS scoring system, an owner and remediated according to our internal SLAs. If necessary, a post-mortem is arranged as a learning exercise for our engineers to improve code security.
Our development process is based on GitHub's pull request mechanism. Once a commit is made to a branch in a specific repository, the code is reviewed by members of the same team or from other engineering teams. Only once the pull request is approved by all tagged engineers is the code moved along in the development life cycle.
When code is committed to GitHub, our continuous integration process automatically initiates a series of tests. One such test is automatic static code analysis, configured to find vulnerabilities both in the code and within its dependencies. Dependency management is performed locally per repository, where all dependencies are tagged by version and downloaded from reputable sources over encrypted HTTPS.
Once the code is ready to be tested, it is deployed to our staging environment. This environment runs a downscaled version of the production infrastructure and does not contain any production data. Quality assurance is performed in a different AWS VPC that is configured with different domain names to ensure complete separation from production.
Security is part of the Product organization and influences the product roadmap and specific features. We implement the philosophy of "security by design" where security features are embedded in the product and architecture design to ensure existing and new functionalities are free of vulnerabilities. We believe that engineers should be responsible for the code they create and have an established culture of accountability, which leads to a high level of code quality and security being maintained.
Blink continually looks out for any indicators that could potentially lead to incidents. To supplement this, any event-alerting tools we use also escalate into PagerDuty rotations for Blink’s 24x7 incident response team. We also maintain an incident response plan that details ways to address an incident, including the processes of notification, escalation, managing and reporting as a result of an incident.
All Blink employees and contracted third parties are required to comply with Blink policies relevant to their scope of work, including security and data privacy policies. Our standard work contract includes confidentiality clauses.
Blink ensures its employees undergo regular security and privacy training. Employees with developer and administrative roles also undergo secure code training annually, while employees with responsibilities in the area of information security are also provided with additional training on security protection techniques, risks, and latest trends.
All hardware devices (desktops, laptops, phones) issued to Blink employees come with encrypted storage partitions as well as MDM software that allows the IT department to monitor, manage, update, and secure the devices and the data contained on them. We make use of the ability to remotely wipe a device in the event of devices getting lost or stolen.
Blink uses Stripe to process credit card payments, which means that no credit card information or related personal information is stored on our servers. Stripe enforces stringent PCI DSS (Payment Card Industry) compliance criteria to ensure that any data stored and/or processed on its servers is handled in a secure way.
In addition to privacy and safety measures, Stripe employs an extensive range of checks designed to minimize payment fraud and unauthorized access. These checks include credit card background checks, flagging suspicious transactions for manual verification, and real-time monitoring of payment transactions with automated anti-fraud algorithms.
To ensure an acceptable level of password security, we have an existing password policy in place based on NCSC guidelines. Passwords that are too generic are not allowed while the use of unique passwords per website is strongly advised. We also provide a password manager to all employees that helps make it easier and safer for them to keep track of their credentials.
The use of multi-factor authentication (MFA) is enforced throughout the main services Blink relies on. The use of MFA provides an additional measure for verifying a user’s claimed identity over the use of just a password. Currently, the minimum requirement for our MFA implementation is the use of a password combined with an access token (for instance, a code provided by Google Authenticator). MFA is also mandatorily enforced for AWS and GitHub access.
We provide Single Sign-On capabilities via SAMLv2. This means our customers have full control over who has access to the use of our product and how authentication takes place. Customers can implement their own password policies and multi-factor authentication implementations.
Your data is protected behind access tokens assigned individually to each user and follow the user's privileges. These keys are rotated hourly. Our application enforces authorization for every API call, apart from assets.
Found a vulnerability? Would you like to report a bug or something interesting that you found? The best way to reach out to us is either via e-mail to firstname.lastname@example.org or opening a ticket. We advise abstaining from publicly announcing a vulnerability or bug before we get in touch with you and work on a fix.
Incidents can happen to anyone — we are ready for such an event when it happens. We manage security incidents via a documented process, which includes notification of and cooperation with customers, data protection authorities, and law enforcement. Blink will notify affected customers within undue delay following incident detection, where we share a preliminary assessment of the incident and are open to cooperation. We follow article 33 of the GDPR when personal data is involved, and alert the supervisory authority regarding breach of personal data.