Security & Compliance

Security and compliance are top priorities for Polyaxon because they are fundamental to your experience with the product. Polyaxon is committed to securing your application’s data, eliminating systems vulnerability, and ensuring continuity of access.

Polyaxon uses a variety of industry-standard technologies and services to secure your data from unauthorized access, disclosure, use, and loss. All Polyaxon employees undergo background checks before employment and are trained on security practices during company onboarding and on an annual basis.

Security is directed by Polyaxon’s Chief Technology Officer.

Infrastructure and Network Security

Physical Access Control

Polyaxon is hosted on Google Cloud Platform. Google data centers feature a layered security model, including extensive safeguards such as:

  • Custom-designed electronic access cards
  • Alarms
  • Vehicle access barriers
  • Perimeter fencing
  • Metal detectors
  • Biometrics

According to the Google Security Whitepaper: “The data center floor features laser beam intrusion detection. Data centers are monitored 24/7 by high-resolution interior and exterior cameras that can detect and track intruders. Access logs, activity records, and camera footage are reviewed in case an incident occurs. Data centers are also routinely patrolled by professional security guards who have undergone rigorous background checks and training.”

Polyaxon employees do not have physical access to Google data centers, servers, network equipment, or storage.

Logical Access Control

Polyaxon is the assigned administrator of its infrastructure on Google Cloud Platform, and only designated authorized Polyaxon operations team members have access to configure the infrastructure on an as-needed basis behind a two-factor authenticated virtual private network. Specific private keys are required for individual servers, and keys are stored in a secure and encrypted location.

Third-Party Audit

Google Cloud Platform undergoes various third-party independent audits regularly and can provide verification of compliance controls for its data centers, infrastructure, and operations. This includes, but is not limited to, SSAE 16-compliant SOC 2 certification and ISO 27001 certification.

In addition, Polyaxon has always a focus on privacy and security. Our unique Hybrid Deployment Model allows us to deliver solutions to companies in regulated industries like financial services and healthcare that have historically been unable to consume SaaS data products at all. And to further enhance our ability to build secure and compliant products, Polyaxon is in the process of SOC 2 certification.

Intrusion Detection and Prevention

Unusual network patterns or suspicious behavior are among Polyaxon’s most significant concerns for infrastructure hosting and management. Polyaxon and Google Cloud Platform’s intrusion detection and prevention systems (IDS/IPS) rely on both signature-based security and algorithm-based security to identify traffic patterns that are similar to known attack methods.

IDS/IPS involves tightly controlling the size and make-up of the attack surface, employing intelligent detection controls at data entry points, and developing and deploying technologies that automatically remedy dangerous situations, as well as preventing known threats from accessing the system in the first place.

Polyaxon does not provide direct access to security event forensics but does provide access to the engineering and customer support teams during and after any unscheduled downtime.

Business Continuity and Disaster Recovery

High Availability

Every part of the Polyaxon service uses properly-provisioned, redundant servers (e.g., multiple load balancers, web servers, replica databases) in the case of failure. As part of regular maintenance, servers are taken out of operation without impacting availability.

Business Continuity

Polyaxon keeps hourly encrypted backups of data in multiple regions on Google Cloud Platform. While never expected, in the case of production data loss (i.e., primary meta-data stores lost), we will restore organizational data from these backups.

Disaster Recovery

In the event of a region-wide outage, Polyaxon will try to bring up a duplicate environment in a different Google Cloud Platform region.

Data Flow

Data into System

Polyaxon provides UI, CLI, CLients, and SDKs that securely send insensitive events and metadata to the API, which processes and stores the metadata.

Data through System

Metadata is sent securely to Polyaxon via TLS to an HTTPS endpoint. All data is AES-256bit encrypted, both in transit and at rest.

Data out of System

Once the metadata is processed, it can then be accessed via Polyaxon’s user interface, CLI, and REST APIs.

Data Security and Privacy

Data Encryption

All data in Polyaxon servers is encrypted at rest. Google Cloud Platform stores and manages data cryptography keys in its redundant and globally distributed Key Management Service. So, if an intruder were ever able to access any of the physical storage devices, the Polyaxon data contained therein would still be impossible to decrypt without the keys, rendering the information a useless jumble of random characters.

Encryption at rest also enables continuity measures like backup and infrastructure management without compromising data security and privacy.

Polyaxon exclusively sends data over HTTPS transport layer security (TLS) encrypted connections for additional security as data transits to and from the application.

Data Retention

Polyaxon retains metadata until the user deletes it by default, regardless of plan.

Polyaxon retains activity logs and audi trail for 3 months for plans with the feature enabled by default, and the service can offer a custom retention interval for customers with custom needs.

Data Removal

All customer metadata stored on Polyaxon servers is eradicated upon a customer’s termination of service and deletion of account after a pre-deletion cleanup and a 4-hour waiting period to prevent accidental cancellation. Data can also be deleted upon request and via Polyaxon’s REST API and UI.

Users have the ability to remove individual metadata via bulk delete buttons.

Application Security

Two-Factor Authentication

In addition to password login, Polyaxon is in the process of implementing a 2FA service.

Two-factor authentication (2FA) will provide an added layer of security to Polyaxon via a time-based one-time password algorithm (TOTP). We encourage 2FA as an important step towards securing data access from intruders. Polyaxon users can deploy universal second-factor devices like YubiKeys (which can also be used to confirm the sudo prompt), TOTP apps like Google Authenticator, or SMS as second factors. This also applies to sign-in with an SSO provider.

Single Sign-On

Polyaxon’s single sign-on (SSO) implementation prioritizes security. We aggressively monitor linked accounts and disable them with any reasonable sign that the account’s access has been revoked. SSO also improves user experience by streamlining login and improving access from trusted domains. Polyaxon currently offers SSO via Google Apps for Work and GitHub Organizations.

SAML 2.0

To facilitate user authentication through the web browser and improve identity management, Polyaxon offers assertion markup language (SAML)-based SSO as a standard feature to customers on its Enterprise plan. SAML 2.0 enhances user-based security and streamlines signup and login from trusted portals to enhance user experience, access management, and auditability.

Polyaxon integrates with SAML 2.0 providers including OneLogin, Auth0, and Okta.

Email Security

Polyaxon service includes email notifications. Sender policy framework (SPF) is a system to prevent email address spoofing and minimize inbound spam. We have SPF records set through Dyn, our domain name service (DNS), and domain-based message authentication, reporting, and conformance (DMARC) set up for monitoring reports to prevent the possibility of phishing scams.

Audit Controls

We know user administration is central to security and management, and auditing user logs is often the first step in both an emergency response plan and policy compliance requirements. All Polyaxon customers get admin controls governing identity, access, and usage to keep your data safe, secure, and centrally managed.

Membership within Polyaxon is handled at the organization level. The system is designed so each user has a singular account that can be reused across multiple organizations (even those using SSO). Each Polyaxon user should have their own account and can choose their own personal preferences and notifications settings. Access to organizations is dictated by role:

  • Outsider
  • Viewer
  • Member
  • Admin
  • Manager
  • Owner
  • Billing

The member list includes the username, email, status, added date, teams, and role for each user. The admin or owner can revoke access by project, team, or org and change the user role. Additionally, the owner can request login and password history and revoke passwords and active sessions for any user via request to Polyaxon Support.

In the audit log, all of the actions by user and action within the Polyaxon UI (e.g., member.invite, project.create) are listed chronologically by time so you’ll always have a view into your organization’s most recent history.

Secure Application Development (Application Development Lifecycle)

Polyaxon practices continuous delivery, which means all code changes are committed, tested, shipped, and iterated on in a rapid sequence. A continuous delivery methodology, complemented by pull request, continuous integration (CI), and automated error tracking, significantly decreases the likelihood of a security issue and improves the response time to and the effective eradication of bugs and vulnerabilities. Release notes and details for Polyaxon can be found on the GitHub release page and release notes (release page and release notes).

Corporate Security

Malware Protection

At Polyaxon, we believe that good security practices start with our own team, so we go out of our way to protect against internal threats and local vulnerabilities. All company-provided workstations have full-disk encryption, screen lock, and other security features.

Risk Management

Polyaxon follows the risk management procedures outlined in NIST SP 800-30, which include nine steps for risk assessment and seven steps for risk mitigation.

All Polyaxon product changes must go through code review, CI, and build pipeline to reach production servers. Only designated employees on Polyaxon’s operations team have secure shell (SSH) access to production servers.

We perform testing and risk management on all systems and applications on a regular and ongoing basis. New methods are developed, reviewed, and deployed to production via pull request and internal review. New risk management practices are documented and shared via staff presentations on lessons learned and best practices.

Contingency Planning

The Polyaxon operations team includes service continuity and threat remediation among its top priorities. We keep a contingency plan in case of unforeseen events, including risk management, disaster recovery, and customer communication sub-plans that are tested and updated on an ongoing basis and thoroughly reviewed for gaps and changes at least annually.

Security Policies

Polyaxon maintains an internal wiki of security policies, which is updated on an ongoing basis and reviewed annually for gaps.

Background Checks

Polyaxon conducts background checks for all new hires.

Security Training

All new employees receive onboarding and systems training, including environment and permissions setup, formal software development training (if pertinent), security policies review, company policies review, and corporate values and ethics training.

All engineers review security policies as part of onboarding and are encouraged to review and contribute to policies via internal documentation. Any change to policy affecting the product is communicated as a pull request, such that all engineers can review and contribute before internal publication. Major updates are communicated via email to all Polyaxon employees.

Disclosure Policy

Polyaxon follows the incident handling and response process recommended by SANS, which includes identifying, containing, eradicating, recovering from, communicating, and documenting security events. Polyaxon notifies customers of any data breaches as soon as possible via email, followed by multiple periodic updates throughout each day addressing progress and impact. Polyaxon Enterprise plans include a dedicated customer success manager who holds responsibility for customer communication, as well as regular check-ins and escalations.

Vulnerability Disclosure

Anyone can report a vulnerability or security concern with a Polyaxon product by contacting [email protected] and including a proof of concept, a list of tools used (including versions), and the output of the tools. We take all disclosures very seriously, and once we receive a disclosure we rapidly verify each vulnerability before taking the necessary steps to fix it. Once verified, we periodically send status updates as problems are fixed.

Minimum supported versions and migrations

We maintain a compatibility matrix to inform our users about the latest releases and the minimum supported versions. As soon as we detected a security issue we make a new release and update the compatibility matrix.