attachmentAV for WordPress - Security

attachmentAV raises the bar for the security of your WordPress site. In the following, we give you insights into our security policies and controls.

ISO 27001 and GDPR compliance (#)

First of all, we are ISO 27001 certified and GDPR complaint.

Here is an exceprt, of our security controls.

• Transmission Confidentiality: We have set up processes to utilize standard encryption methods, including HTTPS with the TLS algorithm, to keep transmitted data confidential.
• Encrypting Data At Rest We have set up cryptographic mechanisms to encrypt all production databases and storage systems that store customer data at rest.
• Centralized Collection of Security Event Logs: Our infrastructure is configured to generate audit events for actions of interest related to security for all critical systems.
• Vulnerability Remediation Process: We identifiy vulnerabilities on the Company platform through the execution of regular vulnerability scans.

For more details about our security policies and controls as well as the certificates, please visit our trust center.

Jurisdiction/Region (#)

attachmentAV for Salesforce processes data in the following jurisdictions/regions:

• EU (European Union)

Are you required to ensure data processing in another region of the world? Let us know!

Protecting data in transit (#)

attachmentAV encrypts data in transit as illustrated in the following figure.

• App sends scan job to backend: HTTPS/TLS
• Backend downloads file from Salesforce: HTTPS/TLS
• Backend sends scan result to app: HTTP/TLS

Protecting data at rest (#)

To be able to scan files for viruses, trojans and other kinds of malware, attachmentAV temporarily persists data.

1. A user uploads a file to WordPress.
2. The plugin sends the file to the backend for scanning.
3. The backend temporarliy persists the file.
4. The backend calls the Sophos engine to scan the file.
5. The backend deletes the file.
6. The backend returns the scan result.
7. The plugin passes or blocks the upload of the file depending on the scan result.

We use encrypted volumes to ensure confidentiality of the temporary data.