Claris Cloud Services Security
Claris International Inc. is committed to excellence — both of its products and how it serves its customers. Our products are designed to help customers make their business better through high performance, secure, and highly available solutions. And, Claris values trust. To demonstrate this, we have consistently applied industry leading security practices to our own practices. These values underpin what we do at Claris.
Claris Platform products such as Claris FileMaker Server and Claris FileMaker Pro have long been architected with industry-standard security technology. And products newer to the platform, such as Claris FileMaker Cloud and Claris Connect, have also been designed to embody the latest security standards and protocols.
The production infrastructure of FileMaker Cloud and Claris Connect is hosted by Amazon Web Services (AWS). AWS data centers and AWS services deliver the physical infrastructure, environmental controls, access control mechanisms, and monitoring systems to enable the highly secure and highly available offerings from Claris. Additionally, Apple provides Claris data center services to support its network, identity platforms, and physical security systems.
Through our relentless commitment to excellence and relationships with AWS and Apple, Claris is able to provide enterprise-grade offerings to organizations of all sizes in its pursuit of enabling digital transformation.
Compliance at Claris demonstrates our ongoing commitment to maintaining rigorous security controls for managing our customers’ data through independent attestation and certification.
Claris has a System and Organization Controls (SOC) 2® Type 2 reports for Claris FileMaker Cloud and Claris Connect that covers internal controls related to the security, availability, and confidentiality of customer data. SOC 2 is an attestation report created by the American Institute of Certified Public Accountants (AICPA).
Claris and Apple engage with external auditors to test the FileMaker Cloud and Claris Connect systems, with the outcome being an opinion over the design and operating effectiveness of the internal control environments.
Both FileMaker Cloud and Claris Connect achieved International Organization for Standardization (ISO) certifications, under Apple’s certification process, from the British Standards Institute (BSI) for Information Security Management (ISO/IEC 27001) and Personal Data in the Cloud (ISO/IEC 27018).
Security and Control Environment
The Information Security Team is responsible for ensuring the confidentiality, integrity, and availability of all Apple and Claris information within facilities, on equipment, or transiting networks owned by or in direct partnership with Apple and Claris. Specific methods used to achieve these objectives include, but are not limited to: development and distribution of security policies and procedures, security assessments, monitoring and processing of security alerts, and responding to security incidents.
People, Policies, and Training
Claris is committed to hiring individuals that are world-class professionals in their discipline and are committed to the key principles of the organization of honestly, respect, confidentiality, and compliance.
To guide its professionals, Claris maintains a set of policies, standards, and guidelines to serve as the body of requirements and guidelines for implementing highly secure and highly available systems.
Based on the policies, standards, and guidelines of the organization, personnel are required to complete new hire and annual security awareness trainings. Those with responsibilities that impact the security of Claris’s products and compliance efforts receive additional training on a variety of topics.
Claris leverages global security frameworks to guide its security processes and controls. Key topics, such as Physical Security, Authentication, Encryption, Network Security, and System Hardening are detailed below.
Physical Security and Environmental Controls
Claris uses Amazon Web Services (AWS) for its hosting needs. AWS has obtained a SOC 2 Type 2 certification over the services used by Claris, including the physical and environmental security control of its data centers.
Additionally, Claris, an Apple company, leverages Apple’s IT services. Apple holds itself to the highest standard, and that is reflected in the way it designs, builds, and operates its data centers. Apple has implemented security controls to limit physical access to its facilities and critical systems, including but not limited to data centers, POD environments, and telecommunications closets. These controls include the proximity badge access system (which strictly limits access to that required to fulfill an individual's job responsibilities), biometric readers, facility camera systems, and visitor logs.
The security of Claris systems, devices, and accounts starts with secure credential creation and management.
Multi-factor authentication
Administrative access to the Claris environments is limited to administrators through multi-factor authentication. Within the Claris environment, Claris deploys the concept of least privilege. Through role-based access control features within AWS, Claris is able to provide highly granular permissions to different types of administrators at Claris (e.g. server administration, database administration, network administration).
Claris ID is an integrated sign-on system for authenticating users of Claris products and services. It also supports authentication via external identity providers including Okta and Microsoft Active Directory.
OAuth identity provider authentication
OAuth 2.0 is used to authenticate Claris users that sign in to custom apps via a third-party identity provider such as Amazon, Google, or Microsoft Azure.
Claris Customer Console is a web application for working with custom apps hosted by FileMaker Cloud and for managing FileMaker Cloud and Claris Connect teams. The console is also used to manage Claris ID accounts, users, groups, hosts, settings, and FileMaker Cloud and Claris Connect subscriptions.
Protecting sensitive information is deeply embedded in Claris’ DNA. Encrypting data in transit and at rest is one of the primary tools Claris employs as a key part of its commitment to customers.
- In transit: Client connections require the use of the TLS 1.2 protocol.
- At rest: FileMaker Cloud utilizes several AWS data storage environments for data persistence. Across these data platforms, Claris utilizes AWS Key Management Service (KMS) for the encryption of data at rest.
- Disk: Claris leverages AWS KMS with AES 256-bit encryption.
- In transit: Client connections require the use of the TLS 1.2 protocol. Certificates and an ephemeral PFS TLS 1.2 cipher are required between hosts (e.g. between the application layer and database layer).
- At rest: Data at rest is stored in enterprise storage solutions with a minimum of AES 256-bit encryption.
- Disk: Claris leverages AWS KMS with AES 256-bit encryption.
Firewalls are an important part of any security effort. In generic terms, a firewall refers to a control that can be used to prevent certain network traffic from entering a private network. Claris leverages firewalls throughout the network and between different zones in the network including application firewalls, web application firewalls, and network-layer firewalls.
Additionally, network traffic is continuously monitored. Refer to the Logging & Monitoring section for further details.
Hardened baseline configurations help drive consistency within the operational environment and provide assurances that systems are built leveraging software approved by Claris, while minimizing the attack surface for a potential malicious code event to exploit.
As part of a baseline configuration, Information Security-approved tools for malicious software detection are default requirements within configuration baselines. These applications provide system-level detection, monitoring, and alerting of potential security events and can prevent malicious code from executing. These tools also have defined integration paths to enterprise monitoring and event management capabilities, allowing the Information Security Team to aggregate themes and activities across the environment, invoke incident response actions, and support forensics investigations.
Security Assessments and Vulnerability Management
Security assessments, performed by the Information Security Team, are performed before production deployments of new or updated features, services, configuration, or code changes.
Security testing of infrastructure, including network devices and operating systems, is supported through vulnerability scanning and subsequent remediation.
Threat Management & Incident Response
Logging Processes and Pipeline
Logging is a critical part of the information security management we do at Claris because logs help ensure the security of Claris systems. The Information Security Team provides product teams with standard methods and tools to easily transmit logs from any system at Claris to the Information Security Team. The event pipeline receives logs from different sources and aggregates them into a single location globally available to authorized incident response personnel.
Incident Response Personnel
The Incident Response Team is a 24/7 team that monitors systems and alerts to initially identify security events and triage incoming alerts. Events are tracked in a centralized tracking tool where details of the event are captured and an impact of the potential business impact of the event. Additional teams are included for remediation of events through a standardized and streamlined process.
Claris relies upon the Incident Management Program of Apple. Apple has implemented an incident management program that includes the policies and procedures to manage risks timely and effectively. Based on the documented Incident Response Plan, security events are assigned to appropriate personnel for analysis prior to an event being designated as an incident. Once identified as an incident, Apple applies a standardized approach of assigning a severity level to the incident to properly classify, prioritize, and respond to the incident. Additionally, the organization has documented its incident communication plan to document and define the roles, responsibilities, compliance obligations, and communication procedures for an incident.
Business Continuity & Disaster Recovery
Claris uses Amazon Web Services (AWS) for its hosting needs. Claris has architected its environment to be highly redundant and provide high availability to its customers.
Additionally, Claris, an Apple company, leverages Apple’s IT services in certain areas. As part of Apple’s ISO 27001 certification process, the data centers of Apple are audited for resiliency and continuity of operations.
Data Management & Privacy
The organization has developed retention policies and schedules to outline the required retention periods for records.
Customer content created within Claris products are available for 45 days after the termination or expiration of customer’s subscription, after which all such content is deleted.
Customer data used to manage user administration (name, email, and phone number) are retained at the discretion of the customer and in compliance with the Claris Privacy Policy.
Claris is committed to customer privacy and complies with applicable privacy regulations in regards to our products and services. Claris collects only the minimum amount of data necessary to provide customers with the services.
GDPR: Claris complies with GDPR; however it is up to our customers to ensure they are creating apps and handling their data in accordance with the provisions of GDPR. For more information on Claris’s compliance with GPDR or if you have a request about GDPR, visit here.
HIPAA: Claris does not claim HIPAA compliance. If you are a covered entity, business associate, or representative of a covered entity or business associate, you agree that you will not use any component, function or other facility of Claris FileMaker Cloud or Claris Connect to create, receive, maintain, or transmit any protected health information.
PCI: Claris is PCI compliant when processing credit cards for its customers. However, Claris products have not undergone a PCI audit, therefore credit card data should not be stored in Claris products.
