Security

Last updated: July 23, 2023

Our commitment to security

Memetria and Stovepipe Studios make the security of your servers and your data our top priority. Our systems were designed from the ground up to be isolated, secure and reliable, while maintaining the high availability your applications need.

Fully Automated Databases

Memetria allows you to choose between major branches of database software in order to opt-in to new or different database features, but you never need to upgrade or maintain patchlevels yourself.

Memetria's team regularly reviews security advisories and rolls out automated patches to your database and underlying system software without disrupting your application.

Credit Card Safety

Memetria does not store any credit card information from customers. Braintree processes payments and stores all payment information. Braintree is an independent, audited, PCI-compliant service.

Privacy

Memetria is committed to the privacy of individuals.

Memetria operates in compliance with the principles of GDPR, LGPD, and other laws and regulatory frameworks designed to safeguard individual privacy. We carefully review and document how data is processed on behalf of our customers.

Memetria complies with the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework, read more about this in our privacy policy.

A Data Processing Addendum (DPA) is included automatically as part of Memetria's Terms of Service. Contact support with any questions about this.

We have a published privacy policy that clearly defines our approach to data privacy, and we take steps to protect the privacy of our customers and their data. You can read more in our privacy policy.

Transport-Layer Security (TLS and SSL)

All Memetria databases support TLS, and can be configured to only accept connections via TLS. Your Memetria account can be configured (in the "Default Settings" menu) to only allow connections via TLS for all resources.

Memetria's roots are kept securely offline. Certificates served up by Memetria databases are signed by an intermediate certificate authority.

Details on configuring TLS connections are integrated into your Memetria dashboard. A copy of our root cert which can be used to verify Memetria connections is available here:

Infrastructure Security

Memetria's primary physical infrastructure runs on Amazon Web Services secure data centers. AWS's data centers are accredited by:

  • ISO 27001
  • SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II)
  • PCI Level 1
  • FISMA Moderate
  • Sarbanes-Oxley (SOX)

Physical and infrastructure-level security, including access control, power redundancy, fire suppression, climate and temperature control, are all maintained by AWS to the state of the art.

Application Security

Our web dashboard and control plane applications undergo regular vulnerability scanning and source code reviews to assess the security of our systems.

We welcome third party vulnerability reports and take them seriously. Please see "Vulnerability Disclosure" below if you have found something that needs our team's attention.

All web application traffic is restricted to TLS/HTTPS only.

All systems at Memetria have a regular cadence of updates so no patch is left behind.

Data Security

All communication with your Memetria databases is optionally encrypted, see "Transport-Layer Security" above.

Database backups are encrypted in transit and at rest.

Employee Access

Stovepipe Studios and Memetria employees never access the contents of hosted databases unless required for support reasons. Staff may log into your account to reproduce bugs or problems, and will look at summary reports on the performance of database queries as part of routine monitoring.

When working on support issues we try to respect your privacy and avoid accessing any information stored in your database unless needed to resolve an issue.

All privileged employee devices which may for support reasons need to access customer data use disk-level encryption and regular security update policies.

All Stovepipe Studios employees agree to all company policies as a condition of employment, including our security and privacy policies.

Vulnerability Disclosure

We appreciate help in disclosing any security issues to us in a responsible and ethical manner.

To report a security vulnerability, the Memetria security team can be reached at security@memetria.com. Security is our top priority at Memetria; we will be in touch with you as soon as possible.

You may use the following public key to keep your message safe:

Fingerprint: 2BB9 08F7 406E 0741 F704  104A 3A32 B2CD 90C3 8CB2
-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEYtcopBYJKwYBBAHaRw8BAQdAblnBr+dPiL/PGq3Rh9WWIzG6uuQ9futbAP2o
c9nEgru0KU1lbWV0cmlhIFNlY3VyaXR5IDxzZWN1cml0eUBtZW1ldHJpYS5jb20+
iJkEExYKAEEWIQQruQj3QG4HQfcEEEo6MrLNkMOMsgUCYtcopAIbAwUJA8JnAAUL
CQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRA6MrLNkMOMsqQsAQCrl9ClBdMi
+FpqzIs1DwNLB5jRDL/pnGMqJPXDBVl0rQD9FFaOk4aJDOvA67g3TK4dOtQQCIO8
q8tdFqgjLAIk+Ai4OARi1yikEgorBgEEAZdVAQUBAQdAVaf02D7tkTtttgUPF/PF
ku5qrxe5PXXFZ7sLoIxvoEEDAQgHiH4EGBYKACYWIQQruQj3QG4HQfcEEEo6MrLN
kMOMsgUCYtcopAIbDAUJA8JnAAAKCRA6MrLNkMOMstmOAQCFVFwRr7xUWk5qvxsr
0kpgSTs52ucVUTDfMMvWdElnEwD9Hq6+tEgrfC2/1Ta835vWvdNPKNUFtvc/LIa0
RB9zWwI=
=dHSf
-----END PGP PUBLIC KEY BLOCK-----