Who We Are

ISAE 3402 Certified

Reach maintains this internationally recognized standard of certification to meet the security needs of financial institutions.

SOC 2 Certified

Reach operates in accordance with the governing protocols of SOC 2. We carry out an annual independent compliance audit and these reports are available if requested.

Independent Penetration Testing

As part of our SOC compliance, Reach regularly engages an independent third-party to carry out security penetration testing of our platform (aka White Hat hacking). Reports are available for client review.

CIS Server Hardening Benchmarks

Reach subscribes to and implements server hardening protocols as published and maintained by the Center for Internet Security to ensure Reach's infrastructure meets or exceeds configuration standards for best practise security.

OWASP Secure Coding Standards

Reach coding standards include mitigations for the OWASP Top10 software coding vulnerabilities.

Surface Scanning

Reach regularly carries out scans of the Reach portals to ensure that SSL and Header support are properly configured at all times.

Threat Detection and Monitoring

Reach uses the full suite of AWS security tools, including AWS GuardDuty that continuously monitors for malicious activity and unauthorized behaviour to protect accounts, workloads, and data.

AWS Shield DDoS Attack Mitigation

Reach uses the full suite of AWS security tools, including AWS Shield, that provides Distributed Denial of Service (DDoS) detection and automatic inline mitigations that minimize application downtime.

New Relic - System Performance Monitoring

In addition to AWS system tools, Reach deploys New Relic active system monitoring tools to track performance and capacity of all active services and equipment. Breach thresholds are alerted automatically to the Reach engineers to remedy before system errors.

Encryption

All Personal Identification Information (PII) data is encrypted at all times. We use 256-bit encryption for all data at rest and 2048-bit private keys for site connections.

Data Sovereignty

Reach ensures data sovereignty by setting up servers in each jurisdiction. At no time will data leave the client's jurisdiction.

Currently Reach has self-contained and quarantined infrastructure in USA, Australia, UK, Canada, Hong Kong, Singapore and EU.

Microsoft Azure - Software Development Lifecycle Management

Reach uses a range of tools including Microsoft Azure for source code management and control; version control and rollback; and branching.

We use Jira to support our Agile development regime.

Global Data Privacy Regulation Compliance

Reach can comply with international privacy regulations as may be required for each project’s jurisdiction. This includes GDPR, CCPA, and Australia’s Data Privacy Act.