Security & Compliance

ISO/IEC 27001:2022

ISO 27001 is the most widely known information security management standard. The ISO/IEC 27001:2022 Information Security Management System of Faria's learning platform has been certified by BSI under certificate number IS 664562. See Faria Security and Compliance.

• About ISO/IEC 27001:2022 and Information Security Management Systems (ISMS)
• Our BSI certificate

Data encryption

All data between your computer and our systems is encrypted end to end with SSL by default. Uploaded assets and backups are also stored and transmitted over encrypted connections. We never send your data over the wire in plain sight, and communications across our internal network use a secure private VPN.

PCI DSS compliance

OpenApply does not store credit card information on any of its servers. Card details are transmitted securely to Stripe, our PCI-compliant payment gateway, which handles the transactions. Because we handle this information securely before passing it to Stripe, we are also PCI Data Security Standard compliant. View our PCI certification.

Legal and privacy

We follow the data privacy policies of the countries where we do business. We host data securely on servers in several locations, including Canada, China and the EU, and follow all rules associated with PIPEDA. Read our full terms of service and privacy policies.

Data protection

Security policy

Our internal security policies are governed under ISO 27001. Key points:

• All access to production data is carefully controlled and limited.
• Physical access to laptops and servers is monitored and controlled.
• Passwords are held to a high standard of security.
• All devices that access our systems are scanned for malware and centrally managed.
• All users complete required security training every year.
• Our Security Incident Response Team is on 24/7 standby and meets weekly to review our security posture.
• We monitor new security threats and major reported breaches and vulnerabilities to understand their potential impact on our operations.

Business continuity and disaster recovery

We have analysed the risks to our business and have a Business Continuity Plan and Disaster Recovery Plan in place, with warm standbys of our applications and data in backup data centres. Our workforce works remote first, so in a natural disaster or serious network issue we can quickly resume operations from other locations.

Further questions

To discuss our security and compliance policies for your own internal records, contact us for a briefing under NDA at security@openapply.com.

Keep your account secure: a termly checklist

Your OpenApply account holds sensitive applicant and family data. Review these settings at least once a term, and update staff access straight away when someone joins or leaves.

1. Passwords: on the admin sign-in page, select Forgot password? to set a new one. Use a strong password you do not use anywhere else; a password manager helps.

2. Two-factor authentication: each user turns it on from their own profile with an authenticator app. An admin cannot turn it on for everyone, but users need it to export data. See Enabling Two Factor Authentication (2FA).

3. Staff directory: in Settings > Staff Directory, archive anyone who has left. Archiving removes their access but keeps their history, and Support can reactivate an account if needed.

4. Permissions: open each active user and check their role. Keep Staff Directory access to the people who manage accounts. See User Permissions.