Pega Cloud Security

Pega Cloud: Security and Reliability - Get the White Paper

How Secure Is Pega Case Management on the Cloud?

When it comes to security, not all cloud offerings are created equal. Some make you share resources with other companies. Others do not provide sufficient levels of communications and physical network security to safeguard the privacy of your data. You’ll never run into these issues with Pega Case Management on the Cloud. Pega Cloud runs on the world's most powerful, secure cloud infrastructure built to help you comply with global privacy and data protection regulations. There are multiple layers of security built into Pega Cloud starting with a virtualized environment that provides each customer with a Private Virtual Infrastructure (PVI). In addition to the firewall protecting the physical servers, each PVI has a configurable software firewall as well as encryption at the operating system, database and Web server level. With Pega Cloud, you gain all the advantages of cloud technology with the assurances you need that your applications and data can be effectively protected.

Tab 1

  • Dedicated Private Tenancy and VPN for each customer
  • Infrastructure and Support Accreditations — ISO 27001, SAS 70 Type II Certified. HIPAA, PCI DSS, FDA 21 CFR and European Union Data Protection Directive compliant
  • Application Isolation — Your applications built on Pega Cloud are completely isolated from other customers’ implementations.
  • Secure Communication Channels —Companies with sensitive data can communicate with the Pega Cloud VPN or HTTPS secure channel. Legacy backend systems can be fully integrated with your applications through the encrypted tunnel created by the VPN.
  • Data Privacy Compliance — All editions of Pega Cloud can meet the requirements of data privacy regulations such as HIPAA, HITECH and PCI DSS.
  • Intrusion Detection — Pega Cloud provides host-based intrusion detection that monitors unauthorized access attempts, suspicious activity and unexpected behavior on any server. Pega Cloud implements automatic countermeasures against several types of network attacks, including port scanning, IP spoofing and denial of service attacks.
  • Fine-Grained Access Controls — Access to Pega Cloud systems is locked down by subnet, port, protocol, server, role and user to allow only the access required for the business function.
  • Single Sign-On Integration — Pega Cloud integrates with your existing identity management solution, such as Active Directory for single sign on, without any coding required. This allows you to maintain centralized control of identity management.

Tab 2

To ensure we can make our customers environments highly available, and that we don't ever lose customer data, we have developed robust disaster recovery and data backup strategies. We can support very aggressive Recovery Time and Recovery Point objects because of the Pega Cloud deployment topology. In addition to the primary private cloud that is provisioned, a second disaster recover site is created. The primary and disaster recover site are identical in every way, and the Database that stores both the rule and transaction data is replicated in real-time from the primary to the disaster recovery site.

Tab 3

Our infrastructure has passed PCI DSS, SAS70 and FISMA moderate audits. Both our cloud infrastructure and our customer support delivery partners have all passed their IS027001 certification, and have built their process on the ITIL framework. This collection of acronyms is very important to the chief security officers of our customers, and it is differentiator between our cloud offerings and other less mature cloud offerings.