Your safety's our priority.
We implement best security practices and meet best international standards to protect information from our customers and their users.
Certificates and standards
Our certification indicates a commitment to the safety, quality and compliance with internationally recognized standards.
ISO 27001
Information Security
Security information management system (SGSI) internationally attested. That standard guarantees that we implement appropriate controls to protect information confidentiality, integrity and availability.
Key benefits
- Structured risk management
- Security policies documented
- Regular internal and external audits
- Continuous improvement of controls
ISO 9001
Quality Management
Quality management system that ensures consistent, documented and customer-oriented processes. It guarantees that our services meet high quality standards.
Key benefits
- Standard and repeatable processes
- Control of documentation and versions
- Customer satisfaction measure
- Non-conformities management
iBeta
Certificated Liveness detection
Certification of detection of presentative attacks (PAD) by standard ISO 30107-3. Our life-testing system has been evaluated by an accredited lab to resist suplanting attempts.
Key benefits
- Protection from printed photos
- Detection of pre-recorded videos
- Mast resistance 2D and 3D
- Evaluation by independent laboratory
NIST 800-63-3
Digital Identity Standards
Compliance with the guidelines of the U.S. National Institute of Standards and Technology for Digital Identity and Authentication Verification, IAL2 and AAL2 levels.
Key benefits
- Robust identity check
- Multifactor Authentication
- Secure Credentials Management
- Protection from identity fraud
Security measures
We put in place multiple layers of security to protect information at all times.
Data collection and protection
- TLS 1.3 figure for all data in transit
- AES-256 figure for data at rest
- HSM key management (Hardware Security Module)
- Automatic encryption key rotation
- Tokenization of sensitive data
Access Control
- Mandatory multifactor authentication
- Role-Based Access Control (RBEC)
- Minimum privilege principle
- Single Sign-On (SSO) empresarial
- Regular review of permits
Secure infrastructure
- Tier III and Certificates Data Centres
- Geo-Retirement of Data
- Firewalls web application (WAF)
- DDOS protection in all layers
- Network and microservice segmentation
Monitoring and response
- Security monitoring 24 / 7 / 365
- OEM system for event matching
- Detection of anomalies with machine learning
- Incident response equipment
- Disaster Recovery Plan (RRP)
Security development
- Security development cycle (SLLC)
- Review of an obligatory code
- Static Security Analysis (SAST)
- Regular penetration tests
- vulnerability management programme
Compliance and audit
- Annual safety audits
- Test for third party penetration
- Unchanging audit record
- Compliance LFPDPPP and LFPIORPI
- Compliance reports for customers
Data protection
We apply high standards to protect personal and biometric information.
Protection of biometric data
The biometric data are treated with the best security measures. We use biometric templates (templates) rather than original images as soon as possible and we apply anonization techniques to protect privacy.
Retention and disposal
We maintain data only for as long as necessary to meet established aims or applicable legal obligations. We have automated secure disposal processes.
Support and recovery
We conduct regular encryption backups, stored at geographically separate locations. We regularly test recovery capacity to ensure service continuity.
International transfers
When transferring data outside Mexico is necessary, we use standard contractual clauses and check that recipients have equivalent protection levels.
Contingency response
We have established processes to detect, respond and report any security incidents quickly and transparently.
Detection
Continuous monitoring with automatic alerts to suspicious events.
Content
Immediate isolation to avoid the spread of the incident.
Communication
Notification to affected parties within 72 hours.
Enhancement
Post-incident analysis and implementation of improvements.
Responsible vulnerability outreach
We value the collaboration of the security community. If you discover a vulnerability, we invite you to report them responsibly.
Programme scope
- Web applications at * .jaak.ai
- APIs public documentation
- SDKs officers JAAK
Reforms vulnerabilities confidential to:
security@jaak.ai