Trust & Security

All new hires undergo background checks before formally starting work as well as security training as part of the Nextpoint onboarding process. Following successful completion of the training, employees sign a confidentiality agreement regarding the protection of client information. Additionally, all employees, regardless of tenure, participate in annual security training. Third-party business associates must sign agreements that include rules and responsibilities regarding confidentiality and security.

Nextpoint’s Site Reliability Engineering Team assesses security risks on an ongoing basis, monitors access logs, addresses known incidents, and applies security patches. Nextpoint conducts a comprehensive, annual IT risk assessment to ensure and maintain SOC II Type 2 Compliance. Nextpoint employs an enterprise Secure Software Development Life Cycle (SDLC) as part of its ongoing commitment to building and maintaining secure applications.

All app admin employee data access is documented via a documentation trail. This trail includes both documentation of the request and the granting of that request by an authorized party. Only a subset of employees have access to the Nextpoint application. Other employees can view account usage summaries but have no access to lower-level client data. Access is promptly revoked for employees who no longer need it, whether or not they continue to be employed by Nextpoint.

Single-sign-on and multi-factor authentication further guard against unauthorized access. Single sign-on (SSO) enables a single login for Nextpoint and other platforms, enhancing security and simplifying daily operations. It gives your IT administrators more control in defining security standards and managing access to data. Nextpoint integrates with Okta and Azure AD, with custom SSO integrations available on request through Client Success. Multi-factor authentication is mandatory for every user and device.

Data is encrypted both at rest and in storage.

Nextpoint is annually audited to ensure it meets the high standards of SOC II Type 2, a security certification that assesses the data management of both human and computer data handlers.

Nextpoint runs on Amazon Web Services and uses several AWS services specifically to support secure infrastructure: CloudWatch for monitoring and alerting on unusual system activity, Virtual Private Cloud (VPC) to isolate and secure the network environment, and Identity and Access Management (IAM) to control employee access to client data. Access to the AWS environment is IP-restricted and locked after five failed login attempts.

Nextpoint’s Site Reliability Engineering Team reviews firewall notifications and operating system event logs on a daily basis. The team also monitors access levels to secured technologies (AWS, the network, the application, etc.) and failed login attempts to the application.

If Nextpoint discovers there may have been an incident in security which has or may have resulted in unauthorized access to Nextpoint protected data, we notify potentially affected users as soon as it’s possible to do so without compromising any investigation or remediation of the breach.

Nextpoint will reasonably cooperate with users in handling of the matter, including, without limitation, (i) assisting with any investigation; (ii) providing users with physical access to Nextpoint facilities and operations affected; (iii) facilitating interviews with Nextpoint employees and others involved in the matter; and (iv) making available all relevant records, logs, files, data reporting and other materials required to comply with applicable law, regulation, or industry standards.

The user shall have the sole right to determine (i) whether notice of the breach is to be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies or others as required by law or regulation and (ii) the contents of such notice, whether any type of remediation may be offered to affected persons, and the nature and extent of any such remediation.