Multiply · Trust Center
Security Controls
We take data security seriously - that's why we're showing you the receipts. No matter in which industry you operate, your data will be secured.
Tap a section to expand its controls. Each item opens independently.
- ✓Confidentiality commitmentsAll personnel accept confidentiality obligations during onboarding and upon policy updates.
- ✓Security policies & ownershipPolicies reviewed at least annually with named owners and version control.
- ✓Background screeningRole-appropriate checks for new hires in line with local laws.
- ✓SSO & MFA enforcedCentralized identity with multi-factor authentication for privileged access.
- ✓Least-privilege provisioningAccess by role; quarterly reviews remove stale permissions.
- ✓Joiner-Mover-LeaverAutomated access changes on hire, role change, and offboarding.
- ✓Inventory of assetsTracked devices, systems, and data stores with ownership and classification.
- ✓Hardening & patchingBaselines with timely security updates and auto-patch coverage.
- ✓Device encryptionFull-disk encryption for company-managed laptops and mobiles.
- ✓Data classification & handlingDefined categories with handling rules for storage, access, sharing.
- ✓Data retention & disposalSchedules applied; secure erasure on request and end-of-life.
- ✓Customer data separationLogical segregation and least-access principles across environments.
- ✓In transitTLS 1.2+ for external connections; HSTS where applicable.
- ✓At restManaged keys; industry-standard ciphers for databases and backups.
- ✓Key managementPeriodic rotation; restricted access with audit logs.
- ✓EDR/antimalwareReal-time protection and telemetry; alerts reviewed.
- ✓Screen lock & idle timeoutAuto-lock enforced; disk encryption required.
- ✓USB & peripheral policyRestrictions on removable media; exceptions documented.
- ✓Segmentation & firewallingLeast-access rules between tiers and services.
- ✓Secure remote accessSSO + MFA for admin; no direct prod access without approval.
- ✓Traffic monitoringIngress/egress logging with anomaly alerting.
- ✓Code review & CI checksPeer review; CI enforces tests and secret scanning.
- ✓Dependency managementAutomated vulnerability alerts and timely updates.
- ✓SDLC policyDocumented stages from design to release with security gates.
- ✓Change trackingAll production changes recorded with sign-off and rollback plans.
- ✓Emergency changesDefined process with post-implementation review.
- ✓Centralized logsCritical system logs aggregated with retention and access controls.
- ✓Alerting & responseThresholds notify on suspicious activity and failed auth attempts.
- ✓IR plan & runbooksRoles, severity levels, and communications templates.
- ✓Tabletop exercisesAnnual practice with lessons captured.
- ✓Customer notificationProcess to inform affected customers and authorities as required.
- ✓Backups & restore testsRegular backups verified via restore tests.
- ✓RTO/RPO targetsDocumented objectives and architecture to meet them.
- ✓Vendor due diligenceSecurity assessments for new vendors; high-risk vendors reviewed annually.
- ✓DPAs & SCCs where neededContractual privacy protections aligned to jurisdictional requirements.
- ✓Scanning & reportingRegular scans of applications and infrastructure with risk-based SLAs.
- ✓Remediation trackingFixes tracked to closure with verification and change control.
- ✓Privacy OfficerHighest authority by default; written delegation with published contact details.
- ✓Confidentiality incidentsIncident register maintained; CAI & affected individuals notified if risk of serious injury.
- ✓PIAs & cross-border transfersPIAs for new systems and before communicating personal info outside Québec; contractual safeguards.
- ✓PIPEDA complianceTen fair information principles; breaches with real risk of significant harm reported & recorded.
- ✓CASL anti-spamValid consent, sender identified, one-click unsubscribe in all CEMs.