Security Whitepaper

The WardPass codebase is publicly available on GitHub, and we encourage security researchers to review our code for vulnerabilities. You can find our code at github.com/wardpass.

SOC 2® Type 2 extends beyond the SOC 2® Type 1 evaluation of the design of controls to examine the operational effectiveness of those controls. The emphasis at this stage is related to service commitments and system requirements based on the TSC over a defined period, typically a minimum of six months. The SOC 2® Type 2 audit process includes a detailed description of the auditor’s tests of controls and results. SOC 2® Type 2 reports are integral for organizations that require ongoing assurance that their information security practices align with industry standards.

SOURCE: https://optro.ai/blog/soc-2-type-1-vs-type-2

AES, the Advanced Encryption Standard, is the current U.S. government standard for a symmetric-key encryption algorithm. A symmetric-key algorithm, also known as a secret key algorithm, is a cryp­togra­phy algorithm that uses the same cryp­togra­phic key for both plaintext encryption and ciphertext decryption. AES has a block size of 128 bits and can have a key size of 128, 192, or 256 bits. AES is defined in the U.S. Federal Information Processing Standard (FIPS) 197 PDF* and it is included in the ISO/IEC 18033-3 standard. It can be implemented in either software or hardware. Modern web browsers provide a low-level interface to cryp­togra­phy functions via the W3C Web Cryp­togra­phy API*. This web app uses a key size of 256 bits, which is currently considered strong enough to protect U.S. government sensitive and important data. In this app, the key is generated from a passphrase by running it through the Password-Based Key Derivation Function 2 (PBKDF2, defined in IETF's RFC 2898*) one million times. AES in Galois/Counter Mode PDF* or GCM is an authenticated encryption algorithm (AEAD, authenticated encryption with associated data). It provides confidentiality and integrity protection by generating both the ciphertext and an authentication tag in a single pass. During decryption, the ciphertext and the authentication tag are passed through the algorithm. If the calculated and expected authentication tags do not match, decryption fails. Unlike the commonly used CBC mode, GCM is not susceptible to padding oracle attacks PDF*. Nor has it the problems of ECB mode, which can reveal structures in the plaintext*. However, NIST* recom­mends* we should not encrypt more than 232 plaintexts with the same key while using a randomly generated initialization vector IV, like this app does. If we restrict the number of plaintexts to 10000, the probability of an IV collision is less than 2-70.

SOURCE: https://crypt-app.net/info/aes-256-gcm.html

This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.

READ MORE AT: https://gdpr-info.eu/