Last Updated: April 11, 2025
At Apprentix, we prioritize the security and privacy of our customers’ data. As a cloud-based Apprenticeship Management System built on Bubble.io and hosted on Amazon Web Services (AWS), we implement comprehensive security measures to protect sensitive information, ensure system integrity, and comply with applicable regulations. This document outlines our security policies, covering data protection, access control, incident response, governance, and more.
1. Introduction
Apprentix is committed to maintaining the confidentiality, integrity, and availability of all customer data, including personally identifiable information (PII), apprentice records, and certifications. Built on Bubble.io and hosted on Amazon Web Services (AWS), we inherit robust security controls from these platforms while implementing additional measures to meet industry standards and regulations such as GDPR and CCPA. These policies apply to all Apprentix employees, contractors, and third-party vendors.
2. Governance and Compliance
2.1 Information Security Program
Apprentix maintains a formal Information Security Program overseen by our Chief Technology Officer (CTO), who serves as the Information Security Officer. The program includes:
Annual risk assessments using the NIST 800-30 methodology to identify and mitigate threats.
Biennial reviews of all security policies to ensure alignment with regulatory and technological changes.
A dedicated security team responsible for monitoring compliance and implementing controls.
2.2 Regulatory Compliance
We comply with relevant regulations, including:
CCPA: For California residents’ data privacy rights.
Other Standards: We align with NIST 800-53, ISO 27001, and SOC 2 frameworks.
We monitor regulatory changes quarterly using AWS Compliance Center and external legal advisors to ensure ongoing compliance.
2.3 Policy Exception Process
Any deviations from these policies require formal approval from the CTO. Exceptions are documented, risk-assessed, and reviewed quarterly to ensure risks are mitigated and accepted by the appropriate risk owner.
3. Data Protection
Apprentix is committed to safeguarding customer data, including personally identifiable information (PII), apprentice records, and certifications. As a platform built on Bubble.io and hosted on Amazon Web Services (AWS), we leverage industry-standard encryption and access controls to ensure data confidentiality, integrity, and availability. This section outlines our data protection practices.
3.1 Data Classification
Apprentix classifies data into four categories to ensure appropriate handling:
Public: Non-sensitive data, such as marketing materials.
Internal: Business data for internal use, like operational reports.
Confidential: Sensitive business or customer data, including apprentice evaluations.
Restricted: Highly sensitive data requiring strict controls, such as PII (e.g., names) and Davis Bacon certificates. Confidential and Restricted data receive enhanced protection through encryption and access restrictions, as detailed below.
3.2 Data Encryption
Apprentix inherits robust encryption from Bubble.io and AWS, supplemented by our own configurations:
In Transit:
All data transmitted between users’ browsers and Apprentix servers is encrypted using HTTPS with TLS 1.3, facilitated by Bubble.io’s integration with Cloudflare.
API calls to external systems (e.g., Oracle HCM) are secured using OAuth 2.0 or API keys over TLS, ensuring secure data exchange.
At Rest:
All data in Apprentix’s databases is encrypted using AWS Relational Database Service (RDS) with AES-256 encryption, covering apprentice records, certifications, and evaluations.
User passwords are salted and hashed for additional security, rendering them non-recoverable.
Uploaded files (e.g., certificates, documents) are stored securely in AWS S3 with AES-256 encryption.
For highly sensitive fields, Apprentix applies additional encryption using Bubble.io’s AES256 Encrypt & Decrypt Plugin before storage, ensuring only authorized users can decrypt and view the data via the frontend.
Endpoints:
Company laptops are protected with full disk encryption using BitLocker (Windows) or FileVault (Mac), both leveraging AES-256.
Removable media containing customer data, if used, is encrypted with AES-256 and restricted by policy to prevent unauthorized access.
3.3 Data Retention and Disposal
Retention:
PII and apprenticeship data are retained for 7 years or as required by customer contracts and regulations (e.g., GDPR, CCPA), stored securely in AWS S3 with versioning and encryption.
Backup data is retained in encrypted form to support disaster recovery, with cross-region replication for redundancy.
Disposal:
Data no longer needed is securely deleted following NIST 800-88 guidelines, using cryptographic erasure for digital data.
Physical media, if any, is shredded by certified third-party vendors to prevent recovery.
3.4 Data Loss Prevention (DLP)
Apprentix employs AWS Macie to monitor and prevent unauthorized data exfiltration. Alerts are generated for anomalous activities, such as attempts to export Restricted data (e.g., apprentice PII). DLP policies are reviewed monthly to adapt to new threats, ensuring proactive protection.
3.5 Data Flow Mapping
We maintain a comprehensive inventory of data flows within Apprentix and to external systems, such as:
Internal flows between Apprentix’s frontend, Bubble.io’s backend, and AWS RDS/S3.
File uploads to AWS S3. Data flows are documented using AWS Data Pipeline tools, ensuring transparency and compliance with cross-border data transfer regulations. For U.S. customers, no international data transfers occur unless explicitly authorized. We maintain an inventory of data flows between Apprentix, AWS, and Bubble.io. Flows are documented using AWS Data Pipeline tools, ensuring visibility into data movement and compliance with cross-border regulations.
4. Access Control and Identity Management
4.1 Role-Based Access Control (RBAC)
Access to Apprentix systems is granted based on the principle of least privilege:
Users (e.g., apprenticeship admins, mentors) have role-specific permissions (view, edit, approve).
Separate profiles are created for each user, with unique credentials tied to their identity.
Access is managed via AWS Identity and Access Management (IAM) and AWS Cognito.
4.2 Multi-Factor Authentication (MFA)
Apprentix provides a configurable MFA setting that Administrators can enable to enhance security:
Admin Access: When enabled, MFA is required for all administrative access to Apprentix. This includes dashboard administration, user management, and system configuration, ensuring privileged actions are protected.
Non-Admin Access: Admins can optionally extend MFA to non-Admin users (e.g., apprentices, managers, mentors).
Default Configuration: MFA is strongly recommended and enabled by default for Admins in new deployments to align with industry best practices, with the option to enforce it for all users based on customer preference.
MFA uses time-based one-time passwords (TOTP) via authenticator apps (e.g., Google Authenticator, Authy) or hardware tokens, implemented by Apprentix beyond Bubble.io’s base authentication capabilities.
For remote access to organizational data (e.g., apprentice records), MFA is enforced when the setting is activated, ensuring compliance with security standards for both Admin and non-Admin users as configured.
4.3 Privileged Account Management (PAM)
Privileged accounts (e.g., system admins) are restricted to authorized personnel.
Access is managed via AWS Secrets Manager, with MFA, session timeouts, and logging via AWS CloudTrail.
Privileged actions are reviewed daily for anomalies.
4.4 Access Approval and Review
Access requests are approved by the system owner (e.g., CTO for backend, team lead for user roles) via a documented workflow.
Access rights are reviewed quarterly using AWS IAM Access Analyzer to ensure appropriateness.
Upon termination or role change, access is revoked within 1 hour via automated HR-integrated workflows.
4.5 Separation of Duties
Critical functions (e.g., development, deployment, auditing) are segregated to prevent conflicts of interest. For example, developers cannot access production data, and auditors cannot modify logs.
5. System Security
5.1 Secure Development
Apprentix is developed within Bubble.io’s no-code platform, which adheres to OWASP Top 10 guidelines through its secure framework. We enhance this with custom workflows and plugins (e.g., AES256 Encrypt & Decrypt) to protect sensitive data.
Security is validated through manual reviews of app logic and workflows by our development team, ensuring robust protection against common vulnerabilities.
Threat modeling (using STRIDE) is conducted during design for all major feature updates to proactively identify and mitigate risks.
5.2 Environment Separation
Development and testing occur in isolated Bubble.io environments, separate from the live production app, with no access to production data.
Production infrastructure is managed by Bubble.io on AWS, with Apprentix data isolated in dedicated RDS/S3 instances. Non-production environments use anonymized synthetic data generated by AWS DataBrew.
5.3 Vulnerability Management
Bubble.io and AWS handle underlying infrastructure vulnerabilities, scanned and mitigated per their policies. Apprentix conducts weekly app-level configuration scans using AWS Inspector and Tenable to identify potential weaknesses.
Critical vulnerabilities are remediated within 48 hours; others within 7 days. We rely on Bubble.io’s secure platform and AWS’s continuous monitoring to maintain a hardened environment, with plans to incorporate third-party penetration testing as our security program evolves.
5.4 Patching
Bubble.io and AWS manage server and platform patching, monitored via AWS Systems Manager Patch Manager. Apprentix ensures app updates (e.g., workflows, plugins) are applied within 7 days of release, tested in staging first.
Critical updates are deployed within 24 hours to address urgent threats.
5.5 Network Security
Bubble.io secures network traffic via Cloudflare, with TLS 1.3 enforced across all connections. Apprentix enhances this with AWS VPCs for backend isolation and AWS WAF to protect against SQL injection, XSS, and DDoS attacks.
Intrusion detection/prevention is provided by AWS GuardDuty, with 24/7 monitoring by Apprentix’s security team.
5.6 Endpoint Protection
Company endpoints are protected by endpoint security software, with real-time anti-malware and behavior monitoring.
Unauthorized software is blocked using AWS Systems Manager allowlists.
Mobile devices use mobile device management (MDM) solutions for containerization, isolating organizational data, with remote wipe capabilities.
6. Incident Response
6.1 Incident Response Plan
Apprentix maintains a formal Incident Response Plan aligned with NIST 800-61, covering:
Preparation: Regular training and tabletop exercises.
Identification: Real-time detection via AWS Security Hub and GuardDuty, supplemented by Bubble.io’s platform monitoring.
Containment: Isolation of affected app components within 1 hour, coordinated with Bubble.io for platform-level issues.
Eradication: Removal of threats and mitigation of vulnerabilities, leveraging Bubble.io/AWS support as needed.
Recovery: Restoration from daily backups within 4 hours.
Lessons Learned: Post-incident reviews to improve controls.
6.2 Incident Logging and Tracking
All incidents are logged in a centralized system, classified by severity (Low, Medium, High, Critical), and tracked to resolution.
Quarterly incident reports are generated for transparency.
6.3 Forensic Investigations
Critical app-level incidents trigger forensic analysis by a third-party provider, while Bubble.io handles platform-level forensics, with findings shared per their policy.
6.4 Notification
Customers are notified within 1 hour of a confirmed breach affecting their data, with updates every 4 hours.
Regulatory bodies are notified as required (e.g., GDPR’s 72-hour rule).
6.5 Testing
The plan is tested semi-annually via tabletop exercises and annually via full simulations.
Last test (Q4 2024) reduced containment time by 20%.
7. Business Continuity and Disaster Recovery
Apprentix ensures service continuity and data recovery through a comprehensive disaster recovery framework, detailed below. This section outlines our customer-facing policy, leveraging Bubble.io and AWS capabilities, with additional internal procedures maintained separately for operational execution.
7.1 Objectives
Recovery Time Objective (RTO): 4 hours for critical systems to minimize downtime.
Recovery Point Objective (RPO): 15 minutes to limit data loss.
Ensure minimal disruption to customer operations during outages.
7.2 Backup Procedures
Data is backed up daily via Bubble.io’s restore points and stored in AWS S3 with versioning and cross-region replication, encrypted with AES-256.
Backups are retained for 7 years or per contract terms, with quarterly integrity tests to verify recoverability.
7.3 Recovery Procedures
In a disaster (e.g., AWS region outage), we fail over to a secondary AWS region (e.g., us-west-2 to us-east-1) within 4 hours, leveraging Bubble.io’s infrastructure.
Bubble.io’s daily restore points enable rapid recovery to the last backup, with Apprentix coordinating app restoration.
If AWS/Bubble.io are unavailable, critical functions (e.g., data exports) use encrypted offline backups, manually processed as an interim measure.
7.4 Alternative Operations
Redundant infrastructure across multiple AWS regions ensures continuity.
Manual processes are documented for offline operations, with client notification within 1 hour of a disruption.
7.5 Testing and Training
Disaster recovery is tested quarterly via tabletop exercises and annually via full recovery drills to validate effectiveness.
All personnel are trained annually on their roles, guided by an internal DR playbook.
7.6 Vendor Coordination
We maintain 24/7 support contracts with AWS and Bubble.io for rapid assistance.
During a disaster, we escalate to AWS Priority Support and Bubble.io’s technical team to expedite recovery.
8. Human Resource Security
8.1 Security Awareness Training
All employees and contractors complete annual security training covering phishing, data handling, and incident reporting.
Quarterly phishing simulations are conducted using KnowBe4, with follow-up training for failures.
8.2 Background Checks
Background checks are performed for all employees handling sensitive data, using a certified provider.
Checks are tailored to role sensitivity, including criminal and reference verification.
8.3 Confidentiality Agreements
All employees and contractors sign non-disclosure agreements (NDAs) upon onboarding, covering PII and proprietary data.
NDAs are enforced without exception, with annual reminders.
8.4 Termination Procedures
Upon termination, access is revoked within 1 hour via automated workflows.
Exit interviews reinforce confidentiality obligations.
9. Supply Chain Security
9.1 Vendor Assessments
Third-party vendors, including Bubble.io and AWS, are assessed for security compliance before engagement and annually thereafter.
Bubble.io leverages AWS’s SOC 2 Type II and ISO 27001 certifications, ensuring a secure foundation for Apprentix.
9.2 Contractual Obligations
Vendor contracts mandate:
Encryption of data at rest and in transit.
Incident reporting within 24 hours.
Compliance with Apprentix’s security standards.
AWS and Bubble.io agreements meet these requirements, with Bubble.io providing platform-level security via AWS.
9.3 Ongoing Monitoring
Vendors are evaluated annually via SOC reports, security questionnaires, and performance reviews.
Last review (Q1 2025) confirmed AWS and Bubble.io compliance.
10. Physical and Environmental Security
As a cloud-based solution built on Bubble.io, Apprentix relies on AWS data centers (West Region, Oregon) managed by Bubble.io, which implement:
24/7 physical security with biometric access, CCTV, and guards.
Visitor logging and escorted access, with no unaccompanied visitors.
Redundant power, cooling, and fire suppression systems per industry standards. Apprentix staff do not access physical data centers, ensuring no local vulnerabilities.
11. Monitoring and Logging
11.1 Security Event Logging
All systems log events to AWS CloudWatch, following NIST 800-92 requirements, with Bubble.io providing platform-level logs (e.g., server uptime).
Apprentix logs app-specific events (e.g., authentication, data access), encrypted and retained for 12 months.
11.2 Continuous Monitoring
AWS Security Hub correlates logs from CloudWatch, GuardDuty, and other sources to detect anomalies in real time.
Privileged and user activity is monitored via CloudTrail, with behavior analytics to identify potential threats.
Alerts are monitored 24/7 by our security team, with escalation within 15 minutes, ensuring proactive response to incidents without reliance on external testing.
11.3 Protective Technologies
AWS GuardDuty provides intrusion detection/prevention at the network perimeter.
AWS Shield mitigates DDoS attacks, with no incidents in 2024.
Web browsing is restricted, blocking malicious URLs.
12. Privacy
12.1 Data Privacy Policy
We comply with GDPR, CCPA, and other privacy laws, ensuring customers’ rights to access, correct, or delete their data.
Privacy notices are provided at data collection points, with consent obtained where required.
12.2 Personal Data Inventory
We maintain an inventory of all PII (e.g., apprentice names, certifications) stored in AWS RDS/S3.
Cross-border data flows are mapped, with no international transfers for U.S. customers unless authorized.
12.3 Data Minimization
Only necessary data is collected and processed, with regular reviews to eliminate redundant data.
Anonymization is used for analytics and testing to protect PII.
13. Customer Responsibilities
While Apprentix implements robust security controls, customers are responsible for:
Configuring user roles and permissions within the platform.
Ensuring their endpoints are secure and free of malware.
Reporting suspected incidents promptly to [email protected].
14. Certifications and Audits
Current: Apprentix leverages AWS’s SOC 2 Type II, ISO 27001, and PCI DSS certifications for our cloud infrastructure, ensuring robust security controls for customer data.
Audits: We conduct annual internal security audits to validate our policies and controls, reviewing app configurations, access controls, and data protection measures. Results are available to customers upon request.
Compliance: We align with GDPR, CCPA, and other applicable regulations, with regular reviews to ensure adherence.
15. Contact Information
For security-related inquiries, contact:
Email: [email protected]
Phone: +1-303-900-2215
Address: 700 Colorado Blvd. #750, Denver, CO 80209
16. Policy Updates
This policy is reviewed biennially or upon significant changes. Updates are communicated to customers via email and our support portal.