Trust is important, Controls are better

Security and Internal Controls for Your Apps and Data at Mendix

Mendix offers an industry-leading application Platform-as-a-Service (aPaaS) for companies to design, build, deploy and manage web and mobile applications. Being a platform provider, it is of utmost importance to ensure that the platform itself, the applications built on the platform and the cloud operations running the platform meet the highest security standards.

Delivering an innovative and secure application platform is the result of comprehensive planning, innovative design, and efficient operations. Mendix makes security a priority at every step, from code development to incident response.

Security Operations

Mendix has adopted a set of security controls from the ISO/IEC 27001:2013 Information Security Framework that govern operations, support and software development life cycles. Mendix has combinations of preventive, defensive and reactive controls to maintain the confidentiality, integrity and availability of the Mendix Platform and customer data.

These controls include:
  • Strict access controls on sensitive data, including two-factor authentication or certificate-based authentication to perform sensitive operations.
  • Background verification checks on operations personnel involved with customer data.
  • Multiple levels of monitoring, logging and reporting, including self-service tools embedded within the Mendix Platform.
  • A 24×7 security incident service that works to mitigate the effects of attacks and malicious activity.
  • A software development lifecycle which embeds security requirements into systems and software through the planning, design, development and deployment phases.

Within Mendix, we understand that customers trust that the privacy of their information will be protected, and that their data will be used in a way that is consistent with their expectations.

Our customers determine what data is submitted to the Mendix Platform as customer data. With respect to such data, Mendix acts as a data processor and addresses the following privacy commitments:

Data Location

Mendix permits customers to specify the particular geography where their customer data will be stored. Data may be replicated for backup within a selected geographic area for redundancy, but will not be replicated elsewhere, so customer data will stay under local law and data privacy protection acts.

Restricted Access

Access to customer data by Mendix personnel is restricted. Customer data is only accessed when necessary to support the customer’s use of the Mendix Platform after explicit authorization by the customer. Furthermore, strong authentication, including the use of two-factor authentication, helps limit access to authorized personnel only. Access of personnel is revoked as soon as it is no longer needed.

Notification of lawful requests

Our customers should control their data when stored within the Mendix Cloud. We will not disclose customer data to law enforcement except as a customer directs or where required by law. When governments make a lawful demand for customer data from Mendix, we strive to be principled, limited in what we disclose, and committed to transparency.

International Standards

Together with our customers, we make sure to comply to international data privacy standards, such as the General Data Protection Regulation (EU) 2016/679.