Learn more about how Perforce approaches data security for its customers.
A core guiding factor in everything that we do is to ensure that our security is robust and included at the beginning of design. This shapes not only how we protect the security and privacy of our systems, networks, services, and data, but that of our customers as well.
To ensure that security is enforced, we operate under several guiding principles to ensure that we effectively address security and privacy.
Our Security Program Overview
Application Security
Perforce develops software that can be accessed via the internet (Software-as-a-Service – SaaS) or that can be directly installed on systems owned by our customers (commonly called on-prem installed software).
A central part of what we do is ensure that our applications are free from defects and are securely designed. All our developed code undergoes robust static analysis and is scanned regularly for vulnerabilities. We keep our development environments separate from our production environments, and tightly control who can access our systems and codebases.
In addition, our applications are regularly tested by third parties to ensure that they do not have vulnerabilities and that they are operating as designed and expected.
Cloud Providers and Data Centers
In general, Perforce Software SaaS tools are hosted at Amazon, Google, and Microsoft datacenters, running on Amazon Web Service, Google Cloud Platform, and Microsoft Azure Cloud services.
These data centers, which are located in the United States and the European Union, provide robust physical security in addition to state-of-the-art fire suppression, redundant power and HVAC, and biometric access controls with stringent least privilege restrictions. Where data centers are employed to host physical equipment, potent tier 3 (or higher) colocation facilities are employed that provide similarly secure protections.
System Security
Perforce regularly replaces their virtual systems with new, patched ones, and works to maintain system consistency using a combination of configuration management, up-to-date images, and continuous deployment. We are constantly working to update our systems to protect your data.
Authentication and Authorization
A centrally managed and administered single sign-on solution (SSO) and a multi-factor authentication (MFA) are used wherever possible to authenticate Perforce employees. In addition, Role-Based Access Controls (RBAC) have been implemented to grant users authorization to access resources only when appropriate for their business needs (and no more than what is necessary) based upon their role.
Data Security
By design, Perforce collects the necessary data for us to effectively do business. Our tools enable customers to store their important data. Therefore, we take the necessary steps to ensure that data is protected when travelling across networks (encrypted with TLS 1.2 or better), when stored (encrypted databases), and ensure that our customers’ data is stored in the fewest number of locations necessary. When not needed anymore, the data is securely deleted.
Network Security
Our network infrastructure is used to monitor and control traffic to ensure that only authorized connections are allowed. When traversing outside and accessing public networks, data is encrypted with industry-accepted encryption mechanisms to prevent eavesdroppers from accessing the data.
Remote Work
When accessing Perforce networks, systems, and services from outside our offices, robust authentication and encryption mechanisms that leverage industry-leading VPN and authentication technologies are used to ensure that security is maintained.
Logging and Alerting
A critical component to Perforce infrastructure is logging, and we’re monitoring our environments to identify any misuse or problems. Logging is used extensively for application troubleshooting and investigating issues, as well as ensuring that everything is functioning as expected. Logs are streamed in realtime and over secure channels to a centralized logging and monitoring service.
Incident Response and Disaster Recovery
At the core of our resilience to the unexpected is having a plan, practicing it, and keeping it up to date. Our first step to prepare for the unexpected is to build our systems and applications with a reasonable level of resiliency. If something does happen, we have a comprehensive communication process to ensure that we are able to recover quickly, securely, and accurately. At the core of this process is ensuring that our people and our customers are safe, before moving on to effectively restore services.
How We Handle Security Regulations and Compliance
SOC2 Type2
Perforce undergoes a SOC 2 Type 2 examination of our security controls against the AICPA defined standards on an annual basis with a third-party audit firm to ensure the security of our platform and its supporting infrastructure. As of the most recent examination, a number of Perforce products are SOC 2 Type 2 compliant.
Privacy-Related Data Mapping and Protections:
Perforce is committed to ensuring ongoing compliance with privacy-related date mapping guidelines, including:
General Data Protection Regulation (GDPR)
The GDPR extends the reach of the European Union’s data protection laws and establishes many new requirements for organizations that fall under its scope.
California Consumer Privacy Act (CCPA)
The CCPA is a state law that provides consumer privacy rights and protections for residents of the state of California.
Led by CISO Aaron Kiemele
As the guide for the ongoing maturation of the information security program, Aaron Kiemele is the Chief Information Security Officer (CISO) at Perforce Software. With a technical foundation, Aaron approaches managing an information security program through a foundation of practical, actionable approaches to protecting the confidentiality, integrity, and availability of systems, networks, services, and data.
Aaron’s experience ranges from network engineering to executive leadership roles — including CTO and CISO — with highly regulated industries, which includes healthcare, government, defense, and payment/finance.
With a “Secure by Design and Compliant by Default” approach, Aaron and his team guides the diverse Perforce product lines through their compliance and regulatory obligations. This work is performed with the help of designated liaisons each time, acting as subject matter experts and points of contact to provide tactical support.
Security & Compliance Current Events
Here at Perforce, we are dedicated to keeping up-to-date on security and compliance events that can impact our products and — especially — our customers.
In response to the Log4Shell vulnerabilities, Perforce has examined the source code of all our product lines to ensure that none have the vulnerable Log4j open-source library.
We also have ensured that the infrastructure and backend environments that support our teams and services have been patched — where necessary — to address the remote code execution issue introduced by the faulty library.
Furthermore, Perforce took an aggressive approach to identifying potentially affected systems and remediating them immediately.