AimBetter Architecture
Data can only flow in one direction – there is no possibility of feedback into or interference with the customer’s domain.
ISO 27001
We are proud to announce that AimBetter has completed the ISO 27001 Compliance process. ISO…
- The Agent is installed on one of the customer’s servers to monitor servers in a local data center, cloud, or hybrid environment.
- Our Agent collects and transmits monitored data to our remote servers via secure SSL-encrypted channels.
- AimBetter servers aggregate and analyze the server performance information and data in our secure Datacenter.
- The resulting server performance reporting is made available via AimBetter’s password-protected website.
- The only data the AimBetter Agent collects is about the performance metrics and Database architecture – no access to the Database content.
Unique AimBetter Security Features
As illustrated in the graphic, there are three primary areas in which the AimBetter product operates. We have introduced specific procedures and technologies within these areas, as well as in the movement of data. Together, these contribute to a security architecture designed to protect the integrity and privacy of customer data and the safety of IT operations.
Customer domain – AimBetter agent
The installation of the agent requires creating a specific user in the customer’s domain. This user has strictly limited access – cannot query/change/drop/create any table or object data on monitored servers.
AimBetter user itself needs only access to its program folder and specific permission on the single-host server. The script that creates this user grants specifically restrictive rights (VIEW) on the database and the server. Additionally, the roles assigned are reader-only. This user cannot make any changes to data or infrastructure. You can check our instructions to create a user with minimal permissions for Windows, Linux, MSSQL, Oracle, and Amazon RDS.
Movement of data
AimBetter monitor pushes information out in a one-way stream from the agent. As an additional level of security, you can block inbound requests. All data is compressed and encrypted, then transmitted via SSL-secured ports through our firewall into our secured data center.
Communication from the AimBetter agents to the AimBetter API complies with the TLS 1.2 security protocol, is outbound on port 443 by default, and can be configured to use a proxy server.
Third-party access
By lifting the monitoring results into our data center, AimBetter provides another level of security. Third-party service providers such as programmers and consultants can also access the information without having to be given access to the customer’s domain.
What We Deliver
We provide full coverage of the following areas:
- Application Security
- Infrastructure & Network Security
- GDPR Compliance
- Data Privacy
- Access Security
- Our employees are required to attend security awareness training and are informed of their security responsibilities.
Data Collection
AimBetter only monitors performance for the applications and/or servers of the customer database environment specified during the installation of the AimBetter agent. Generally, the monitor collects metadata that includes aggregate time measurements for server resource utilization statistics, server error logs, SQL server resources, SQL server query statistics, and SQL errors.
AimBetter agent processes:
- Database query activity
- Database utilization metadata (database size, SQL response time, number of requests, etc.)
- Database errors (query error code, query timeout expired, duplicate key, etc.)
- Server utilization metadata (CPU usage, memory, disk, network utilization, etc.)
- Server event log
- Client CPU and process
We offer an optional separate function that can collect and report on connection performance to non-database-related hardware and services (disks, drives, folders, websites, etc.)
User Access Management
Users access the results of AimBetter’s services through their unique username (usually email address) and password. These passwords must meet a high level of complexity (for example – a minimum of eight characters with mixed cases and special characters). Customers are responsible for managing their accounts, including provisioning and de-provisioning their own users. We store user passwords in an advanced, industry-standard encrypted hash format.
AimBetter adds the following mechanisms to protect against access violations:
- Multiple login failures (up to five) will block the user and enforce re-authentication.
- Customers can specify a range of valid IP addresses from which access is permitted.
- Customers can opt for 2FA (two-factor authentication) by Email or Google Authenticator
- Customers can integrate AimBetter with their Identity Provider to authenticate users via SSO if it supports the SAML 2.0 protocol.
- The user access is session protected, meaning that the user will be logged out if there is any change in the IP
Privacy
AimBetter is committed to protecting the privacy of our customers. The application data we process as part of our service provision is used only to display application performance information to the customer’s AimBetter account users or to our Expert Support team to facilitate their support activities.
We undertake never to provide data to third parties without the customer’s explicit approval.
AimBetter only collects metrics relevant to server activity (for example, the creation/reading/update of data), which are passed through the firewall for analysis.
Data retention persists only during the period of service. Upon termination of AimBetter services, all data will be removed from AimBetter systems (including backups) within 90 days.
Datacenter Security
AimBetter is hosted at our Tier3+ certified data center. Physical access to this location is restricted to people with authenticated credentials, and all access/egress is reported.
The center is equipped with fully redundant power backup systems, fire suppression systems, security guards, and biometric authentication systems.
Our data center is protected by Cloudflare, firewalls, a VPN gateway, and intrusion detection systems.
All of our system databases are locally encrypted and cannot be accessed except via username/password access.
Summary
- We guarantee the complete security of your data, both onsite, in transit, and via user access.
- AimBetter guarantees the integrity of your site. There is no channel for data or programs to be uploaded into your location from our service.
- The flow of data is strictly one-way – outward from your domain.
- Our operations are completely limited to observation inside the customer’s domain – we cannot make any changes to data or software.
- We use leading-edge data encryption technology in all traffic movement between your site and our center.
- Our own Datacenter is protected physically and logically to prevent access except by authenticated users. Security on-site is at the same level as banking and insurance Datacenters.
- Access to our service is restricted to authenticated users, with measures to detect and prevent attempted hacking.
Premium Security
On top of AimBetter’s already secure-by-design architecture, we offer additional security conditions for customers with more stringent compliance requirements who want complete separation from the general environment.
Secure-by-design additional references
Agent Viewing List
As part of AimBetter’s Zero Trust policy, our agent access is restricted to the Data…
Regulation Compliance Features
AimBetter powerful solution equips companies with the capabilities to meet various regulatory standards, enhancing their…
How AimBetter helps you achieve GDPR Compliance and Peace Of Mind
Meaning of General Data Protection Regulation General Data Protection Regulation (GDPR) applies rules that companies…
