Security at Blink

Introduction.

Security is a top priority at Blink and we live it in our day-to-day activities. We’ve built a comprehensive security program that is in line with Cyber Essentials and National Cyber Security Centre (NCSC) Cloud Security Principles. Our Senior Management team is accountable for security and ensure that security capabilities and competence exist in all levels of our business.

As a whole, we follow a holistic and collaborative approach to guarantee the confidentiality, availability, and integrity of your data. On this page, you can read about the various policies and security measures taken by Blink to secure user content and data hosted on our platform from unauthorized access.

How we protect your content.

Our infrastructure runs purely on Amazon Web Services (AWS), which delivers infrastructure as a service with prime security capabilities.

ISO 27001 compliant data centres

The data centres used for storing your content and allowing it to be delivered to your users are certified for compliance with the ISO 27001 standard. This standard details requirements for an information security management system (ISMS) within an organization, that is AWS, to ensure they systematically evaluate risks, threats and vulnerabilities to their information security, and having controls and a management process to constantly manage risk and meet security needs. To provide unbiased neutrality, certification is carried out by independent third-party auditors.

Data storage and encryption at rest

Your data is encrypted at rest in AWS S3 buckets, AWS RDS instances and block devices used by AWS EC2 instances. AES-256 encryption is used by default via AWS’ encryption services, while key management is handled by AWS KMS. This ensures the content is preserved and safe from prying eyes and manipulation.

All user passwords are hashed using the Bcrypt password hashing function and stored in the database. Bcrypt uses salts and 10 rounds of an algorithm to increase the complexity of hashing to minimize the risk of passwords being cracked. **

Encryption in transit

All communication between you, your services and Blink, that includes your data, traverses the Internet via encrypted HTTPS traffic using TLS. This encryption during communication ensures information cannot be read or manipulated by unauthorized third parties.

ISO 27001 compliant data centres

All communication between you, your services and Blink, that includes your data, traverses the Internet via encrypted HTTPS traffic using TLS. This encryption during communication ensures information cannot be read or manipulated by unauthorized third parties.

How we keep our service reliable.

AWS

Our infrastructure runs in Amazon Web Services, where all components are deployed in at least three availability zones, minimizing disruptions caused by any failure and keeping your content constantly available. Elastic Load Balancers are used to automatically split the load and segregate traffic from the Internet to all nodes of our frontend layer.

Auto-scaling

Our platform has been designed from scratch to support high volumes of web traffic and this technology stack is the fundamental piece that caters to our high availability needs. We utilise varies AWS tools to achieve this high level of availability.

Distributed denial of service (DDOS) protection

Our APIs and web application are protected in multiple ways against denial of service attacks. AWS provides volumetric denial of service protection through AWS Shield and Elastic Load Balancing to ensure high availability. Our security CDN performs application-layer denial of service protection alongside web application firewall protection.

Disaster recovery and business continuity

Blink utilizes database replication architectures to ensure redundancy and uptime. Encrypted backups are made frequently and stored both onsite at the data centre and copied to a remote storage location. Each key service layer has redundant components, such as multiple servers that provide the same service and content, to ensure any failures do not impact the rest of the system. Data centres are also equipped with controls to enforce physical security and protection against environmental hazards.

How we keep our code secure.

Vulnerability management

Once a vulnerability is detected, it is assigned a score, using the CVSS scoring system, an owner and remediated according to our internal SLAs. If necessary, a post-mortem is arranged as a learning exercise for our engineers to improve code security.

Code peer review

Our development process is based on GitHub's pull request mechanism. Once a commit is made to a branch in a specific repository, the code is reviewed by members of the same team or from other engineering teams. Only once the pull request is approved by all tagged engineers is the code moved along in the development life cycle.

Automatic static code analysis

When code is committed to GitHub, our continuous integration process automatically initiates a series of tests. One such test is automatic static code analysis, configured to find vulnerabilities both in the code and within its dependencies. Dependency management is performed locally per repository, where all dependencies are tagged by version and downloaded from reputable sources over encrypted HTTPS.

Quality Assurance (QA)

Once the code is ready to be tested, it is deployed to our staging environment. This environment runs a downscaled version of the production infrastructure and does not contain any production data. Quality assurance is performed in a different AWS VPC that is configured with different domain names to ensure complete separation from production.

Secure SDLC

Security is part of the Product organization and influences the product roadmap and specific features. We implement the philosophy of "security by design" where security features are embedded in the product and architecture design to ensure existing and new functionalities are free of vulnerabilities. We believe that engineers should be responsible for the code they create and have an established culture of accountability, which leads to a high level of code quality and security being maintained.

How we keep our code secure.

Security monitoring and Incident Management

Blink continually looks out for any indicators that could potentially lead to incidents. To supplement this, any event-alerting tools we use also escalate into PagerDuty rotations for Blink’s 24x7 incident response team. We also maintain an incident response plan that details ways to address an incident, including the processes of notification, escalation, managing and reporting as a result of an incident.

Security awareness program

All Blink employees and contracted third parties are required to comply with Blink policies relevant to their scope of work, including security and data privacy policies. Our standard work contract includes confidentiality clauses.
Blink ensures its employees undergo regular security and privacy training. Employees with developer and administrative roles also undergo secure code training annually, while employees with responsibilities in the area of information security are also provided with additional training on security protection techniques, risks, and latest trends.

Mobile device management (MDM)

All hardware devices (desktops, laptops, phones) issued to Blink employees come with encrypted storage partitions as well as MDM software that allows the IT department to monitor, manage, update, and secure the devices and the data contained on them. We make use of the ability to remotely wipe a device in the event of devices getting lost or stolen.

Security policies

Blink has multiple internal policies directly pertaining to or containing details about data privacy, security, and acceptable use; the most widely distributed and available of which is the employee handbook that includes documentation on security, data privacy, and related measures. In addition, Blink also has a public-facing privacy policy, as well as a security whitepaper and numerous security data sheets that are available on request from your Blink sales contact or account manager.

Credit card/payment security

Blink uses Stripe to process credit card payments, which means that no credit card information or related personal information is stored on our servers. Stripe enforces stringent PCI DSS (Payment Card Industry) compliance criteria to ensure that any data stored and/or processed on its servers is handled in a secure way.
In addition to privacy and safety measures, Stripe employs an extensive range of checks designed to minimize payment fraud and unauthorized access. These checks include credit card background checks, flagging suspicious transactions for manual verification, and real-time monitoring of payment transactions with automated anti-fraud algorithms.

Password managers and policy

To ensure an acceptable level of password security, we have an existing password policy in place based on NCSC guidelines. Passwords that are too generic are not allowed while the use of unique passwords per website is strongly advised. We also provide a password manager to all employees that helps make it easier and safer for them to keep track of their credentials.

Multi-factor authentication

The use of multi-factor authentication (MFA) is enforced throughout the main services Blink relies on. The use of MFA provides an additional measure for verifying a user’s claimed identity over the use of just a password. Currently, the minimum requirement for our MFA implementation is the use of a password combined with an access token (for instance, a code provided by Google Authenticator). MFA is also mandatorily enforced for AWS and GitHub access.

SSO

We provide Single Sign-On capabilities via SAMLv2. This means our customers have full control over who has access to the use of our product and how authentication takes place. Customers can implement their own password policies and multi-factor authentication implementations.

API keys - key rotation

Your data is protected behind access tokens assigned individually to each user and follow the user's privileges. These keys are rotated hourly. Our application enforces authorization for every API call, apart from assets.

How to report vulnerabilities

Found a vulnerability? Would you like to report a bug or something interesting that you found? The best way to reach out to us is either via e-mail to support@joinblink.com or opening a ticket. We advise abstaining from publicly announcing a vulnerability or bug before we get in touch with you and work on a fix.

In case of a security incident

Incidents can happen to anyone — we are ready for such an event when it happens. We manage security incidents via a documented process, which includes notification of and cooperation with customers, data protection authorities, and law enforcement. Blink will notify affected customers within undue delay following incident detection, where we share a preliminary assessment of the incident and are open to cooperation. We follow article 33 of the GDPR when personal data is involved, and alert the supervisory authority regarding breach of personal data.