Security

Bento Holdings is committed to strength within the supply chain. We align our security practices with SOC for Service Organizations Security Trust Service criteria through BCSF 1.0 adoption and attestation.

Supply Chain

Bento Holdings considers all vendors which transmit, store, or otherwise access customer data or customer environments as materially significant. As such, all materially significant vendors are required to maintain a current SOC 2 Type 2 attestation in Security. We maintain a continuously updated database of vendors and routinely review SOC reports. Current vendor statistics can be obtain by emailing support.

Data Hosting

Bento Holdings physical infrastructure is hosted and managed within Amazon’s secure data centers. We leverage all applicable platform security, privacy and redundancy features. AWS continually monitors its data centers for risk and undergoes assessments to ensure compliance with industry standards. Amazon’s data center operations have been accredited under: ISO 27001, SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II), PCI Level 1, FISMA Moderate and Sarbanes-Oxley (SOX).

Encryption

Data that passes through Bento Holdings is encrypted, both in transit and at rest. All connections from the browser to our platforms are encrypted in transit using TLS SHA-256 with RSA Encryption. We require HTTPS for all services.

Background Checks

All Bento Holdings employees go through a thorough background check before hire.

Training

While we retain a minimal amount of customer data and limit internal access on a need-to-know basis, all employees are trained on security and data handling to ensure that they uphold our strict commitment to the privacy and security of your data.

Confidentiality and NDA

All employees sign a confidentiality agreement before they start at Bento Holdings.

Business Continuity

We have business continuity and disaster recovery plans in place that replicate our database and back up the data onto multiple cloud providers to ensure high availability.

Monitoring

Bento Holdings continuously scans our products for service interruptions, performance degradation and security vulnerabilities to immediately alert our engineers and take action when an incident has been detected.

Mobile Device Management

We secure our employees’ machines and laptops using mobile device management to ensure that each device follows our information security standards, including encryption.

Malicious Software Prevention

Our employees’ equipment is defended by anti-malware software, and we run routine phishing tests to further educate and train employees.

Patching

We keep our systems up to date with the latest security patches and continuously monitor for new vulnerabilities through compliance and security mailing lists. This includes automatic scanning of our code repositories for vulnerable dependencies.

PGP Key

You may transmit to us confidential information encrypted using PGP. Below is our public key.