Security Controls

The controls below apply to all NowForce Mobile App customers.

Security Control Processes

  • Routine antivirus scanning with continuously updated definitions.
  • Amazon Web Application Firewall (WAF) protects against denial-of-service (DDoS) and cross-site scripting (XSS) attacks.
  • Continuous security updates to patch known vulnerabilities in operating systems and third-party components.

Application Security

Intellicene follows established secure development practices:

  • Development staff are trained in the Microsoft Security Development Lifecycle (SDL).
  • All software development is subject to routine vulnerability assessments and penetration testing.
  • Static code analysis is run as part of the development process.

Data Control

Customer data is encrypted both while it is moving across networks and while it is stored at rest:

  • Data in transit: SSL/TLS 1.2 is used for all communications.
  • Data at rest: encryption using industry-standard algorithms (available for SaaS customers).

Access Control

Privileged access to all systems is controlled and monitored. User access to data and systems is granted on a least-privilege basis.

Standard controls:

  • Intellicene administrators use multi-factor authentication to access the cloud production environment.
  • Access to the NowForce API uses OAuth 2.0 authentication.
  • Customers manage their own user access through the NowForce admin console.

Enabled by default for every customer:

  • Unique credentials per user.
  • Login audit logging.
  • Per-device unique mobile ID, allowing administrators to block or disable unauthorized devices.
  • Enforce by default use of strong password.

Optional, configurable per customer:

  • Strong password enforcement.
  • Multi-factor authentication (MFA).
  • OAuth 2.0.
  • MSAL-based enterprise SSO.
  • Conditional access IP range lock.
  • Single device login.