Document effective January 4, 2021

Security is fundamental to us !

Money Avenue LLC meets all industry standards to safeguard your data. We use a variety of methods to secure our network and servers as well as our software and web applications. Our data retention and business continuity plans are comprehensive and our employees maintain organizational security measures designed to keep your data safe.

Network and Server Security

• Network infrastructure is segregated into levels of information classification with strict routing, firewalling, and access control links that separate each privilege level.
• Network infrastructure undergoes regular internal penetration testing audits that are augmented by semi-regular third-party audits and penetration testing.
• Our information security team performs regular software updates throughout the Money Avenue infrastructure to remain up-to-date on software security patches.

Software and Web Application Security

• Web APIs and web pages are secured and up to date security configurations.
• Money Avenue’s cloud infrastructure employs Multi-Factor Authentication for management operations.
• Industry-standard (symmetric and asymmetric) encryption algorithms with appropriately sized keys are used to protect sensitive customer information.
• Money Avenue applications undergo regular internal source code audits. Internal audits are augmented by semi-regular third-party audits.
• Standards and leading practices identified by independent security organizations (e.g., OWASP) are integrated into all Money Avenue code creation processes.

Data Retention & Disaster Recovery

• Data is aggressively archived and Money Avenue performs regular offsite backups to ensure redundancy.
• Money Avenue services are designed to tolerate failures in supporting infrastructure while maintaining continuity of operations; we place a high priority on redundancy and ensuring maximum availability of our services.
• Money Avenue follows industry standard incident response procedures.

Organizational Security

• Prospective employees undergo security screenings during the hiring process.
• Money Avenue employees undergo security operations training.
• Money Avenue employees use encrypted storage, encrypted chat (and voice), encrypted tunnels (VPN and SSH), and encrypted email for sensitive internal communications and operations.
• Money Avenue maintains detailed application-level and system-level logs.

Security Research and Disclosure Process

Money Avenue understands the devotion and effort that security work requires. As such, we encourage (and reward) the responsible disclosure of any vulnerabilities to us. Responsible disclosure means:

• Openly share the full details of any vulnerabilities with us.
• Do not announce or share the details of any vulnerabilities in any way with the public or other parties.
• Do not exploit the vulnerability except for purposes of demonstrating it to Money Avenue personnel. Please contact security@moneyave.comif you are unsure of exploitability and we will work with you to verify it safely.
• Do not use the vulnerability to access, modify, harm, or otherwise alter any Money Avenue (or its customers’) data.

Vulnerabilities that are “responsibly disclosed” according to the above process are welcomed. Money Avenue will not seek to bring legal action against any person who adheres to this process of responsible disclosure.  

You may also contact us with any security concerns, or security suggestions at security@moneyave.com.