Our Security

Privacy is a core value. At mRelief, we believe that all Americans in need should be able to identify what resources in the safety net are available to them without having to give away significant amounts of personal identifiable information. But as we have transitioned to helping people at every step in SNAP enrollment, that is, until they are approved we have had to develop a secure environment to support our shared goals of increasing SNAP participation for those who are eligible. Here are some of the measures we have taken to level up our security while promoting participation:

We require employees to sign confidentiality agreements who access user data. We think of user data as people who are applying for SNAP, but also providers of SNAP who view client data. This also goes for volunteers and anyone that engages with our clients. We are also really intentional about the identity of users even when they volunteer to share their story.

As founders we have participated in security awareness events. While we are always open to White Hat Hackers who will help us identify ways to make our data even more secure, we have led public conversations at Data and Society and welcomed feedback about ways we can increase our security and access controls. We also work with security consultants to ensure that all processes adhere to industry best practices.

Our Security Stack Currently, mRelief’s data is hosted through Amazon Web Services through Heroku. Amazon continually manages risk and undergoes recurring assessments to ensure compliance with industry standards. Amazon’s data center operations have been accredited under:

• ISO 27001
• SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II)
• PCI Level 1
• FISMA Moderate
• Sarbanes-Oxley (SOX)

Deletion. While there are certain aspects of information we must secure per our contracts with governments, we are diligent about deleting social security from our database after 60-days, for those who apply online through our system. We will also delete social security numbers included on any online application on mRelief’s servers.

However, we will store social security numbers provided through applications conducted over the phone for auditing purposes in compliance with telephonic signature rulings.

Encryption. Encryption key management runs on the AWS Key Management Service platform. Unique customer master keys are generated using the AES-256 algorithm. Data is encrypted in transit and at rest. Additionally, data is protected by SSL.

We employ testing and patch management, too. All web-applications and interfaces have continuous integration tests that run before each deployment. We leverage vulnerability management and application security support provided by Heroku (service provider). This includes a vulnerability management process on the Heroku environment with information from internal and external assessments, system patch monitoring, and 3rd party mailing lists and services.

Our approach to passwords. For the cloud application platform and database, passwords must be 8 characters also they must contain three of the four - capital, lower, number or symbol. We also are diligent about making sure inactive sessions time out after 30 minutes of inactivity.

Logs of activity. mRelief has an auditable log of application code changes and deployments. Logs are retained on a rotational basis, storing the last 1,500 lines of logs. Access to logs are restricted to authorized personnel. Personnel is prohibited from tampering with logs.

To partner with mRelief and our secure end-to-end process, click here.