Turbine Cloud Security and Compliance

Swimlane Turbine enables you to securely access and manage your content. Technical and physical controls within Turbine prevent the disclosure of content and the unauthorized access to content. The infrastructure is continuously monitored, and internal and external security staff regularly conduct vulnerability testing.

Swimlane extensively leverages security automation and response to alert suspicious activity across customer and corporate environments. Internally, confidentiality requirements are communicated to employees through training and policies. Employees are required to attend security awareness training, which includes information, policies, and procedures related to protecting our customers’ data.

Swimlane provides a number of security features within Turbine cloud, which helps ensure the confidentiality, integrity and availability of customer information.

Here is how Turbine cloud protects your data at rest:

Swimlane protects your data in motion by using Transport Layer Security, or TLS, (versions 1.2 and 1.3) to encrypt data between the Swimlane application servers and client browsers, as well as the Swimlane database.

Swimlane supports local user account provisioning, Open LDAP, Microsoft Active Directory, and SAML 2.0.

For more information on how Swimlane utilizes SAML, see Enable SAML for SSOEnable SAML for SSO.

Account administrators can enable Two-Factor Authentication or 2FA for their account and optionally exempt specific users from the requirement. If 2FA is not enforced at the account level, individual users may still enable it through their personal settings. By default, 2FA is not globally enforced since it requires setup before activation.

For more information on 2FA and Swimlane, see Enable Two-Factor AuthenticationEnable Two-Factor Authentication.

Swimlane limits access to information by using Role-Based Access Control (RBAC). You can apply RBAC at every level of objects within Swimlane: workspaces, dashboards, reports, applications, records and individual records. Granular controls can be applied down to the individual field level, and all components support the ability to restrict access via user, group or role.

Swimlane can dynamically adjust permissions on a per-record basis based on user/group field values, as well. For example, if a record is assigned to Group A, only Group A and administrators will have access to that record. If the assignment of the record changes to Group B, then only Group B and administrators will have access to the records.

With Turbine cloud, administrators also have the ability to separate the account administrator from the orchestrator and playbook designer.

For more information about RBAC, see Role PermissionsRole Permissions and the other permissions topics within the Turbine guide.

Swimlane restricts access to production systems to a handful of employees. The list of employees with access to production is audited regularly.

Swimlane welcomes reports from security researchers and experts about possible security vulnerabilities in our product. To report a security vulnerability in Swimlane, please send details to [email protected]. Swimlane does not have a bug bounty program.

Data centers hosting Turbine cloud have achieved compliance with ISO/IEC 27001:2013, 27017:2015, 27018:2019, 27701:2019, 9001:2015, and CSA STAR CCM v3.0.1.

Additionally, all data centers have completed the following examinations:

For more information, see the Swimlane Trust Center.