To ensure the highest security standards, MyPass conducts continious vulnerability, configuration and postune management scans. This comprehensive scanning includes all production systems, applications, and servers.

All detected vulnerabilities or configuration issues are classified based on the severity, impact, and the likelihood of exploitation. This systematic approach allows us to effectively manage and mitigate potential risks in our cloud infrastructure.

Absolutely. MyPass prioritizes data security, especially during data transit. One of our fundamental security measures is the mandatory use of SSL (Secure Sockets Layer) certificates for all communications both within thee data centres and over the internet. This ensures that any data exchanged between users and MyPass is encrypted, significantly enhancing security and protecting against data interception or unauthorized access during transmission.

Note that strong cipher and protocols are used in the configuration of all transport security.

Yes, MyPass ensures that all sensitive data is encrypted when stored in our environment. This includes any data at rest within the MyPass Cloud, MyPass/FastPass Gateway as well as any data store.

For specific details on the types of data that are read, stored, and require write access in target repositories such as Active Directory and Entra ID, we recommend consulting the respective documentation on the MyPass Documentation site. This information will give you a comprehensive understanding of our data handling practices and the security measures in place to protect your data at all times.

Systems integrated into MyPass/FastPass are requiresd to provide connection credentials for normal operations. These credentials are stored within the custommer environment on the MyPass/FastPass Gateway server. This provide maximum control to critical credentials.

Note it is also possible to bring your own keys for the encryption of this data. For more information regarding this, please reach our to the MyPass team.

MyPass/FastPass is also strongly aligned with controls within FIPS (Federal Information Security Management) 140-2 standards, starting from version 4.0 onwards. We utilize a 256-bit AES algorithm for encryption and a PBKDF algorithm for hashing. This compliance extends across all components, from the Windows Client to the Server including Domain Controller communiations ensuring robust security throughout the system.

MyPass/FastPass provides the functionality to automatically delete user data and restrict access as needed. This is achieved by regularly checking the source user repository. User data can be set to be automatically deleted under certain conditions, such as if the user account is deleted or disabled, is no longer a member of a group authorized to use MyPass/FastPass, or becomes a member of a group specifically designated for deletion. This ensures that user data management aligns with the current status and permissions within the organization.

Please note that the users history actions are kept in the Audit log for security reasons and the user deprovisioning process can also assist with licenses harvasting.

Yes, we keep a comprehensive and detailed audit log that meticulously records every action. This includes not only user activities but also all operations conducted within the Help Desk tool and the Administration interface. This extensive logging capability ensures thorough tracking and accountability for all interactions within the platform, providing an essential tool for security and administrative oversight.

This data is not deleted, even if the use information is removed for POPIA / GDPR reasons.

We do everything that we can to maintain secure operations for our customers. This includes technology, people and process controls.

All personnel supporting our platforms are subject to BGV check and trained on Data Protection best practices. They are also required to sign NDAs and the Information Security Policy and our Data Protection policies.

Our service also offers an automated Deprovisioning Service that clears up all unused data from the platform to maintain only data in support of active users and processes.

FastPass ensures regular updates for optimal performance and security. For the server components, such as the SSPR backend and IVM, we typically release a major version upgrade once a year. Additionally, we provide 2-3 smaller updates annually, focusing on introducing new features and addressing bug fixes.

It's important to note that the Windows Client, along with the Password Interceptor and Filter components, are designed to be backward compatible with the latest two major versions. This compatibility feature offers flexibility and ease during the upgrade process, ensuring a smooth transition for users and IT administrators.

Note that all MyPass Cloud customer benefits from complete version lifecycle management as part of the service. Any changes to Windows Clients are communicated directly to customers from the MyPass Team.

(On-Premise Customers Only)

FastPass adopts a version-based approach for our End-of-Life policy, focusing on Major and Minor releases. We offer support for the current Major release and the last officially released Major version. For instance, as of now, we support versions 3.6 and 4.0. This means that if you encounter any issues with version 3.6, our support team will assist you, including making necessary fixes to facilitate upgrades. However, we do not provide the same level of support for versions that are two Major releases behind the current one. To ensure continuous support, we recommend upgrading at least once every year, aligning with our Major version release cycle.