Data retention policy
All active Customer Data shall be retained for as long as the Customer continues to be an active
Customer of Casepoint or unless a request has been made by the active Customer for the deletion of
data.
All Customer Data, after termination of contract, must be retained in accordance with the contractual
agreement between Customer and Casepoint.
Customer Data retention policies may be implemented against Customer Data on an ad-hoc basis as
maybe agreed between Casepoint and Customer.
Data archiving and removal policy
Disposal of customer data will be carried out in accordance with the contractual agreement between
Casepoint and Customer. In the absence of any contractual agreement, an automatic script or manual
script (for ad-hoc requests) is initiated on Casepoint platform containing customer data. This
activates a full hard delete of customer data on the platform.
Data storage policy
Casepoint produces, controls, and distributes symmetric and asymmetric cryptographic keys for Casepoint using FIPS 140-2 compliant key management technology and processes. Casepoint only uses the Advanced Encryption Standard (AES) encryption algorithm for symmetric and asymmetric cryptographic keys. Casepoint uses Federally approved and validated cryptography wherever possible in Casepoint. By using FIPS validated encryption. Moreover, Casepoint mandates the use of TLS 1.2 and above for internal and external data communication. The processed data is then stored on various Network Attached Storage (NAS) file shares within the Casepoint network. All servers and attached storage drives are encrypted and access to this file share is restricted to use only SMB 3.1.
Casepoint tests backup information at least annually, and generally multiple times a year. Casepoint will run disaster recovery scenarios/tests. The tests include failover to the secondary, hot-site and recovery of the data from the same. Casepoint stores backup copies of organization-defined critical information system software and other security-related information in geographically diverse data centers.
App/service has sub-processors
no