Security

attachmentAV scans your files for viruses and other malware. This page describes how widdix GmbH, the company behind attachmentAV, protects the data you entrust to us. It is the Security Documentation referred to in the attachmentAV Customer Terms.

How we handle your files

  • Files you submit for scanning are transmitted in encrypted form.
  • We store a file only transiently and in encrypted form for the duration of the scan and delete it immediately after the scan result has been produced. We do not retain copies of scanned files.
  • The scan is fully automated. Our personnel have no interactive access to scanned files.
  • As part of the scan, the anti-malware engine provided by Sophos may transmit a cryptographic hash of the file to Sophos for a reputation lookup. No file content is transmitted.
  • We retain scan metadata and logs only for the limited periods stated in the Data Processing Agreement.

Processing regions

We process scanned files in the EU (AWS region eu-west-1, Ireland) by default. Depending on the product, you can select another processing region: United States, Canada, India, or Australia.

The hash-based reputation lookup is routed to a Sophos endpoint in the United States, Ireland, Germany, India, Japan, or Australia based on latency. We cannot select the endpoint.

ISO 27001 certification

We maintain an information security management system certified under ISO/IEC 27001:2022. You can find the certificate as well as our security policies and controls in our Trust Center.

Security measures

  • Encryption: TLS 1.2 or higher for all connections to and from attachmentAV. Transient file storage, databases, and backups are encrypted at rest.
  • Access control: Role-based access with least-privilege policies, multi-factor authentication for all administrative access, named accounts instead of shared credentials, and periodic access reviews.
  • Separation: Separate production, staging, and development environments. Customer data is logically separated by account, API key, and platform instance.
  • Availability: Redundant deployment across multiple AWS availability zones in the processing region, automated scaling, monitoring and alerting, and DDoS protection by the hosting provider.
  • Backup and recovery: Daily backups of configuration, account, and metadata stores with 35 days’ retention. The documented restore procedure is tested annually. Scanned files are not stored persistently and are therefore not backed up.
  • Logging: Scan requests, results, and actions as well as administrative access are logged. Logs are protected against alteration.
  • Vulnerability management: Automated vulnerability and dependency scanning, patching of critical vulnerabilities within 3 days, and annual external penetration tests.
  • Secure configuration: Infrastructure as code with version control and peer review, and hardened base images.
  • Physical security: Processing takes place exclusively in data centers of AWS, whose physical security controls are certified under ISO/IEC 27001, SOC 2, and other standards. Our personnel have no physical access to the data centers.
  • Organization: Information security policy, defined roles and responsibilities, a risk management process, an incident response procedure, annual internal audits, and data protection training for our personnel on joining and annually.

The complete list of technical and organizational measures is part of the Data Processing Agreement (Annex III).

Security by product

Each product comes with its own security page covering details such as data flows, permissions, and processing regions.

attachmentAV Virus and Malware Scan API (Self-hosted on AWS) is different from the other products: you deploy and operate it in your own AWS account, and scanned files are not transmitted to us. The sections on file handling, processing regions, and security measures above describe the infrastructure we operate and therefore do not apply to it.

Sub-processors

The list of sub-processors names the companies we engage to provide attachmentAV.

Questions

Do you have questions about security at attachmentAV? Let us know!