IMPORTANT -- READ CAREFULLY: BY CREATING AN ACCOUNT OR BY UTILIZING THE aioBoard SERVICE YOU AGREE TO BE BOUND BY THESE TERMS AND CONDITIONS.
Welcome to the aioBoard service, website or mobile application (collectively, the "Service"). Your use of the Service is subject to these Terms of Service and aioBoard’s Privacy Policy (collectively, the “Terms of Service” or “Agreement”). These Terms of Service are a legal agreement between You and aioBoard, Inc. (“aioBoard”), a Delaware Corporation, for use of the aioBoard service. "You" refers to any individual who creates an account on the Service, or, if the Service is being used on behalf of an entity by an individual authorized to agree to such terms on behalf of such entity, then "You" refers to such entity. If You are accessing the Service on behalf of Your employer, you represent and warrant that You have the authority to agree to these Terms of Service on its behalf. If You do not agree with the terms of this Agreement, do not use the Service. aioBoard reserves the right to update and change the Agreement from time to time without notice or acceptance by You. The Agreement will also be applicable to the use of the Service on a trial basis. By using the Service, You signify Your irrevocable acceptance of this Agreement. The website and any downloadable software associated with the Service are protected by copyright laws and international copyright treaties, as well as other intellectual property laws and treaties.
The Service includes, and is limited to, a service, web site, or mobile application that allows You access to and use of a single aioBoard Account. "aioBoard" referred to herein means an online collaboration tool that organizes projects into boards. The Service may contain information, data, text, photographs, videos, audio clips, written posts and comments, software, scripts, graphics, and interactive features generated, provided, or otherwise made accessible on or through the Service (collectively, “Content”). Subject to these Terms of Service, aioBoard grants to You and each user of the Service a worldwide, non-exclusive, non-sublicensable and non-transferable license to use (i.e., to download and display locally) Content solely for purposes of using the Service. Use, reproduction, modification, distribution or storage of any Content for other than purposes of using the Service is expressly prohibited without prior written permission from us. You shall not sell, license, rent, or otherwise use or exploit any Content for commercial use or in any way that violates any third party right. For the purposes of these Terms of Service, “Content” also includes all User Content (as defined below).
A "aioBoard Account" or "Account" referred to herein means a service, web site, or mobile application, provided by aioBoard, where You may use aioBoard to create, update, share, and publish information, data, text, messages or other materials ("User Content").
Without limiting the foregoing, the Service is not designed or licensed for use in hazardous environments requiring fail-safe controls, including without limitation operation of nuclear facilities, aircraft navigation/communication systems, air traffic control, and life support or weapons systems.
Unless explicitly stated otherwise, any new features that augment or enhance the current Service, including the release of new tools and resources, shall be subject to the Agreement. In order to use the Service, You must obtain access to the World Wide Web, either directly or through devices that access web-based content, and pay any service fees associated with such access. In addition, You must provide all equipment necessary to make such connection to the World Wide Web, including a computer and modem or other access device. You also understand and agree that the service may include certain communications from aioBoard, such as service announcements, administrative messages, etc., and that these communications are considered part of the Service and You will not be able to opt out of receiving them. You agree not to access the Service by any means other than through the interfaces that are provided by aioBoard for use in accessing the Service. aioBoard will provide the Service in accordance with this Agreement. aioBoard may at its sole discretion modify the features of the Service from time to time without prior notice.
In order to use the Service, You must have a valid Account. To acquire an Account for the Service, You must provide aioBoard with an electronic mail address and other information ("Registration Data"). You are responsible for maintaining the confidentiality of the access data for Your Account, and are fully responsible for all activities that occur under Your Account. You agree to (a) immediately notify aioBoard of any unauthorized use of Your Account or any other breach of security, and (b) ensure that You exit from Your Account at the end of each session. aioBoard cannot and will not be liable for any loss or damage arising from Your failure to comply with this section. In consideration of use of the Service, You agree to: (a) provide true, accurate, current and complete information about Yourself as prompted by the Service's registration form, and (b) maintain and promptly update the Registration Data to keep it true, accurate, current and complete. aioBoard assumes no duty to verify such information as further detailed in the CONTENT OF THE SERVICE section of these Terms of Service. If You provide any information that is untrue, inaccurate, not current or incomplete, or aioBoard has reasonable grounds to suspect that such information is untrue, inaccurate, not current or incomplete, aioBoard has the right to suspend or terminate Your Account and refuse any and all current or future use of the Service (or any portion thereof). By using the Service (and registering an Account on the Service), You represent and warrant that You are at least 13 years of age, and no one under the age of 13 may use the Service - except as set forth below under "Kids Under 13 and aioBoard". aioBoard may, in its sole discretion, refuse to offer the Service to any person or entity and change its eligibility criteria at any time. You are solely responsible for ensuring that these Terms of Service are in compliance with all laws, rules and regulations applicable to you and the right to access the Service is revoked where these Terms of Service or use of the Service is prohibited or to the extent offering, sale or provision of the Service conflicts with any applicable law, rule or regulation.
aioBoard is not directed to children, and we expect that any use by children will only be done with the guidance, supervision and consent of their parents, guardians and/or authorized school officials. aioBoard relies on parents and guardians to ensure that minors only use aioBoard if they can understand their rights and responsibilities as laid out in these Terms of Service and in our Privacy Policy.
In the event that you are a school, district or teacher in the United States and want your students, who are under the age of 13, to create aioBoard accounts - including in conjunction with the establishment of a aioBoard Gold or Business Class account - you agree that you are responsible for complying with the U.S. Children's Online Privacy Protection Act ("COPPA") and, to the extent applicable, the Family Educational Rights and Privacy Act ("FERPA"). This means that you must notify the students' parents/guardians of the personally identifiable information that aioBoard will collect, and that you will obtain parental/guardian consent before your students establish accounts or use aioBoard. When obtaining such consent, you must provide parents/guardians with a copy of our Privacy Policy. You must keep all consents on file and provide them to us if we request them. For more information on complying with COPPA, see the Federal Trade Commission's website. If you are located outside of the United States, we will rely upon you to obtain any required consent or approval from the parent or guardian of any student covered by similar laws, and, as a condition to your and your students' use of aioBoard, you agree that you will be responsible for complying with such laws.
Additional groupings of features may be added to the Service and made available to You as a paid upgrade ("Paid Plan"). If You choose to subscribe to a Paid Plan, You shall pay fees (described below) to aioBoard. Upon selection of a Paid Plan, You will provide aioBoard with the necessary billing information ("Billing Data").
Credit cards are the only payment mechanism aioBoard will accept for payment of a monthly or yearly subscription fee ("Subscription Fee") for a Paid Plan. All currency references are in U.S. dollars. Paid Plans can be paid as either a monthly Subscription Fee or a yearly Subscription Fee.
If you select a Paid Plan, You must provide current, complete and accurate Billing Data. You must promptly update all Billing Data to keep Your Account current, complete and accurate (such as a change in billing address, credit card number or credit card expiration date) and You must promptly notify aioBoard if Your Payment Method is changed (for example, for loss or theft) or if You become aware of a potential breach of security, such as the unauthorized disclosure or use of Your name or password. If You fail to provide any of the foregoing information, You agree that aioBoard may continue charging You for any use of the Paid Plan under your Billing Data unless You have terminated Your Paid Plan as set forth herein.
If You select the Monthly Fee, the credit card that You provide as part of the Billing Data will be automatically and immediately billed on the first Business Day of each Month. You agree that aioBoard may charge to Your credit card all amounts due and owing for Your Account on that monthly basis or upon cancellation (see "Termination, Breach, Suspension and Cancellation" and "Refund"). If You select the Yearly Fee, the credit card that You provide as part of the Billing Data will be automatically and immediately billed on the day You sign up. You agree that aioBoard may charge to Your credit card all amounts due and owing for Your Account on that yearly basis unless you cancel the account (see the "Termination, Breach, Suspension and Cancellation" and "Refund" sections of these Terms of Service). aioBoard will contact You via electronic mail to alert You upon each charge. aioBoard may change prices at any time without prior notice, but will endeavor to provide reasonable advance notice via the aioBoard website and/or electronic mail. You agree that in the event aioBoard is unable to collect the fees owed to aioBoard for Your Account through Your Subscription Fee, aioBoard may take any other steps it deems necessary to collect such fees from You and that You will be responsible for all costs and expenses incurred by aioBoard in connection with such collection activity, including collection fees, court costs and attorneys' fees.
As long as Your Account remains active and in good standing, You will be charged the Subscription Fee even if You never use the service. You may, however, cancel Your Paid Plan at any time.
If Your Subscription Fee payment is overdue, aioBoard will disable Your access to the features provided by the Paid Plan. aioBoard may, at its sole discretion, at any time and for any reason, terminate the Service, terminate this Agreement, or suspend or terminate Your Account. In the event of suspension or termination, Your account will be disabled and You may not be granted access to Your Account or any files or other Content (including Your User Content) contained in Your Account, and aioBoard may delete Your User Content, although residual copies of information may remain in our system for some time for back-up purposes. In the event of termination, aioBoard may also withdraw and at its discretion reallocate the public web address of Your Account.
If You terminate Your Account, via means provided for cancellation on the aioBoard website, or via telephone call or electronic mail to aioBoard, and You request that aioBoard delete Your User Content and files contained in Your Account, aioBoard will make all reasonable efforts to do so.
aioBoard provides means for Account and Paid Plan cancellation on the aioBoard website. If You cancel Your Account within 90 calendar days of the date of sign up, and You request a refund, aioBoard will refund all payments You have made to aioBoard within the 90 calendar days prior to the cancellation and refund request.
aioBoard and/or its suppliers, as applicable, retain ownership of all proprietary rights in the Service and in all trade names, trademarks and service marks associated or displayed with the Service. You will not remove, deface or obscure any of aioBoard's or its suppliers' copyright or trademark notices and/or legends or other proprietary notices on, incorporated therein, or associated with the Service. You may not reverse engineer, reverse compile or otherwise reduce to human readable form any software associated with the Service.
aioBoard is a Trademark of aioBoard, Inc.
You acknowledge that the Service, or portion thereof may be subject to the export control laws of the United States. You will not export, re-export, divert, transfer or disclose any portion of the Service or any related technical information or materials, directly or indirectly, in violation of any applicable export law or regulation.
You acknowledge that any use of the Service contrary to this Agreement, or any transfer, sublicensing, copying or disclosure of technical information or materials related to the Service, may cause irreparable injury to aioBoard, its affiliates, suppliers and any other party authorized by aioBoard to resell, distribute, or promote the Service ("Resellers"), and under such circumstances aioBoard, its affiliates, suppliers and Resellers will be entitled to equitable relief, without posting bond or other security, including, but not limited to, preliminary and permanent injunctive relief.
aioBoard does not claim ownership over any User Content submitted on or through the Service. Your User Content belongs to You. However, by uploading any User Content to the Service, You agree that aioBoard may store and display (only to You, to the extent that You make such User Content private) Your User Content solely as necessary in connection with the Service. To the extent You choose to share any of Your User Content with other users of the Service, You agree to allow these users (i.e., only the users you specify) to view Your User Content and, to the extent applicable, collaborate with You and Your User Content.
You understand that all User Content is the sole responsibility of the person from which such User Content originated. This means that You, and not aioBoard, are entirely responsible for all User Content that You upload, post, transmit or otherwise make available via Your Account. aioBoard does not control the User Content posted via the Service and, as such, does not guarantee the accuracy, integrity or quality of such User Content.
You understand that by using the Service, You may be exposed to User Content that is offensive, indecent or objectionable. Under no circumstances will aioBoard be liable in any way for any User Content, including, but not limited to, for any errors or omissions in any Content, or for any loss or damage of any kind incurred as a result of the use of any Content posted, transmitted or otherwise made available via the Service. You acknowledge that aioBoard does not pre-screen User Content, but that aioBoard and its designees shall have the right (but not the obligation) in their sole discretion to refuse, modify or move any Content that is available via the Service. Without limiting the foregoing, aioBoard and its designees shall have the right to remove any User Content that violates the Agreement or is otherwise objectionable. You agree that You must evaluate, and bear all risks associated with, the use of any Content, including any reliance on the accuracy, completeness, or usefulness of such Content. In this regard, You acknowledge that You may not reasonably rely on any Content created by aioBoard or submitted to aioBoard. You acknowledge and agree that aioBoard may preserve User Content and may also disclose User Content if required to do so by law or in the good faith belief that such preservation or disclosure is reasonably necessary to:
(a) comply with legal process;
(b) enforce the Agreement;
(c) respond to claims that any Content violates the rights of third-parties; or
(d) protect the rights, property, or personal safety of aioBoard, its users and the public.
If aioBoard discloses User Content to comply with legal process or respond to claims that any User Content violates the rights of third-parties, to the extent permitted by law, regulation or legal process, aioBoard agrees to provide You with prompt notice of any such legal or governmental demand and reasonably cooperate with You in any effort to seek a protective order or otherwise to contest such required disclosure.
You understand that the technical processing and transmission of the Service, including Your User Content, may involve (a) transmissions over various networks; and (b) changes to conform and adapt to technical requirements of connecting networks or devices.
Should User Content be found or reported to be in violation with, but not limited to, the following terms, it will be in aioBoard's sole discretion as to what action should be taken. You agree that You will not:
(a) upload, post, transmit or otherwise make available any User Content that is unlawful, harmful, threatening, abusive, harassing, tortuous, defamatory, vulgar, obscene, libelous, invasive of another's privacy (up to, but not excluding any address, email, phone number, or any other contact information without the written consent of the owner of such information), hateful, or racially, ethnically or otherwise objectionable;
(b) harm minors in any way;
(c) impersonate any person or entity, including, but not limited to, a aioBoard official, forum leader, guide or host, or falsely state or otherwise misrepresent Your affiliation with a person or entity;
(d) forge headers or otherwise manipulate identifiers in order to disguise the origin of any User Content transmitted through the Service;
(e) upload, post or otherwise transmit any User Content that You do not have a right to transmit under any law or under contractual or fiduciary relationships (such as inside information, proprietary and confidential information learned or disclosed as part of employment relationships or under nondisclosure agreements);
(f) upload, post or otherwise transmit any User Content that infringes any patent, trademark, trade secret, copyright, rights of privacy or publicity, or other proprietary rights of any party;
(g) upload, post, or transmit unsolicited commercial email or "spam". This includes unethical marketing, advertising, or any other practice that is in any way connected with "spam", including but not limited to (a) sending mass email to recipients who haven't requested email from You or with a fake return address, (b) promoting a site with inappropriate links, titles, descriptions, or (c) promoting Your site by posting multiple submissions in public forums that are identical;
(h) upload, post or otherwise transmit any material that contains software viruses or any other computer code, files or programs designed to interrupt, destroy or limit the functionality of any computer software or hardware or telecommunications equipment;
(i) interfere with or disrupt the Service or servers or networks connected to the Service, or disobey any requirements, procedures, policies or regulations of networks connected to the Service;
(j) intentionally or unintentionally violate any applicable local, state, national or international law, including, but not limited to, regulations promulgated by the U.S. Securities and Exchange Commission, any rules of any national or other securities exchange, including without limitation, the New York Stock Exchange, the American Stock Exchange or the NASDAQ, and any regulations having the force of law;
(k) "stalk" or otherwise harass another;
(l) promote or provide instructional information about illegal activities, promote physical harm or injury against any group or individual, or promote any act of cruelty to animals. This may include, without limitation, providing instructions on how to assemble bombs, grenades and other weapons or incendiary devices.
(m) offer for sale or sell any item, good or service that (i) violates any applicable federal, state, or local law or regulation, (ii) You do not have full power and authority under all relevant laws and regulations to offer and sell, including all necessary licenses and authorizations, or (iii) aioBoard determines, in its sole discretion, is inappropriate for sale through the Service provided by aioBoard;
(n) use the Account website as a redirecting/forwarding service to another website;
(o) exceed the scope of the Service that You have signed up for; for example, accessing and using the tools that You do not have a right to use, or having humans share User logins, or deleting, adding to, or otherwise changing other people's comments or User Content as an Account holder. If any user is reported to be in violation with the letter or spirit of these terms, aioBoard retains the right to terminate such account at any time without further warning.
Apple Device and Application Terms. If you are accessing the Service via an application on a device provided by Apple, Inc. (“Apple”) or an application obtained through the Apple App Store (each an “Application”), the following shall apply:
Apple, the Apple logo, iPhone and iPad are trademarks of Apple Inc., registered in the U.S. and other countries. App Store is a service mark of Apple Inc. Google Play is a trademark of Google Inc.
In-App Purchases. Through the Application, You may purchase (“In App Purchase”) keys or other goods or services (collectively, “Goods”). To the extent You purchase Goods through the Apple iTunes service, you are agreeing to Apple’s iTunes’ Terms and Conditions (http://www.apple.com/legal/itunes/us/terms.html).
You agree that aioBoard has no responsibility or liability for the deletion of, or the failure to store or to transmit, any User Content and other communications maintained by the Service. You acknowledge that aioBoard may establish general practices and limits concerning use of the Service and may modify such practices and limits from time to time. aioBoard retains the right to create limits on use and storage at our sole discretion at any time with or without notice. You acknowledge that we reserve the right to log off users who are inactive for an extended period of time.
You agree that You will not:
(a) upload, post, email, or otherwise transmit any computer routines, files or programs designed to interrupt, destroy or limit the functionality of any computer software or hardware or telecommunications equipment;
(b) interfere with or disrupt our Service or networks connected to our website or through the use of our Service, or disobey any requirements, procedures, policies or regulations of networks connected to our website or through the use of our Service, or otherwise interfere with our Service in any way, including through the use of JavaScript, ActiveX or other coding;
(c) take any action that imposes an unreasonable or disproportionately large load on our infrastructure; or
(d) copy, reproduce, alter, modify, or publicly display any information displayed on the Service (except for Your User Content), or create derivative works from our website (other than from Your User Content), to the extent that such action(s) would constitute copyright infringement or otherwise violate the intellectual property rights of aioBoard or any other third party, except with the prior written consent of aioBoard or the appropriate third party.
aioBoard takes no responsibility for any third-party Content or User Content (including, without limitation,any viruses or other disabling features), nor does aioBoard have any obligation to monitor such third-party Content. aioBoard reserves the right at all times to remove or refuse to distribute any Content on the Service, such as Content which violates these Terms of Service. aioBoard also reserves the right to access, read, preserve, and disclose any information as it reasonably believes is necessary to (a) satisfy any applicable law, regulation, legal process or governmental request, (b) enforce these Terms of Service, including investigation of potential violations hereof, (c) detect, prevent, or otherwise address fraud, security or technical issues, (d) respond to user support requests, or (e) protect the rights, property or safety of aioBoard, its users and the public. aioBoard will not be responsible or liable for the exercise or non-exercise of its rights under this Agreement.
If aioBoard discloses such information to satisfy any applicable law, regulation, legal process or governmental request or to respond to user support requests, to the extent permitted by law, regulation or legal process, aioBoard agrees to provide You with prompt notice of any such demand and reasonably cooperate with You in any effort to seek a protective order or otherwise to contest such required disclosure.
Your aioBoard profile page is public. This includes your name and any activity that you have had on (including without limitation any User Content that you have submitted to) public boards.
Recognizing the global nature of the Internet, You agree to comply with all local rules regarding online conduct and acceptable User Content. Specifically, You agree to comply with all applicable laws regarding the transmission of technical data exported from the United States or the country in which You reside.
You agree not to reproduce, duplicate, copy, sell, resell or exploit any portion of the Service, use of the Service, or access to the Service without the express permission by aioBoard.
You represent and warrant that (a) all of the information provided by You to aioBoard to participate in the Service is correct and current; and (b) You have all necessary right, power and authority to enter into these Terms of Service and to perform the acts required of You hereunder.
You understand and agree that the Service is provided "as is" and aioBoard, its affiliates, suppliers and Resellers expressly disclaim all warranties of any kind, express or implied, including without limitation any warranty of merchantability, fitness for a particular purpose, non-infringement or bailment of your data on aioBoard's servers. aioBoard, its affiliates, suppliers and Resellers make no warranty or representation regarding the results that may be obtained from the use of the Service, the security of the Service, or that the Service will meet any user's requirements. Use of the Service is at Your sole risk. You will be solely responsible for any damage to You resulting from the use of the Service. The entire risk arising out of use, security or performance of the Service remains with You. No oral or written information or advice given by aioBoard or its authorized representatives shall create a warranty or in any way increase the scope of aioBoard's obligations. Without limiting the foregoing, the Service is not designed or licensed for use in hazardous environments requiring fail-safe controls, including without limitation operation of nuclear facilities, aircraft navigation/communication systems, air traffic control, and life support or weapons systems. Without limiting the generality of the foregoing, aioBoard, its affiliates, suppliers and Resellers specifically disclaim any express or implied warranty of fitness for such purposes.
You agree to indemnify, defend and hold harmless aioBoard, its affiliates, officers, directors, employees, consultants, agents, suppliers and Resellers from any and all third party claims, liability, damages and/or costs (including, but not limited to, attorneys fees as and when incurred) arising from Your use of the Service, Your use of Your Account, Your violation of these Terms of Service or the infringement or violation by You or any other User of Your Account, of any intellectual property relating to the Service (including without limitation Your User Content) or other right of any person or entity.
aioBoard reserves the right at any time and from time to time to modify or discontinue, temporarily or permanently, the Service (or any part thereof) with or without notice at any time. You agree that aioBoard shall not be liable to You or to any third party for any modification, suspension, termination or discontinuance of the Service.
No agency, partnership, joint venture, employee-employer or franchiser-franchisee relationship between You and aioBoard Software is intended or created by these Terms of Service.
In no event will aioBoard or its affiliates, suppliers or Resellers be liable for any special, incidental, indirect, exemplary or consequential damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or any other pecuniary loss or damage) arising out of the use of or inability to use the Service, or the provision of or failure to provide technical or other support service, whether arising in tort (including negligence) contract or any other legal theory, even if aioBoard, its affiliates, suppliers or Resellers have been advised of the possibility of such damages. In any case, aioBoard's, its affiliates', suppliers' and Resellers' maximum cumulative liability and Your exclusive remedy for any claims arising out of or related to this Agreement will be limited to the amount actually paid by You for the Service (if any) in the previous twelve (12) months.
Failure by either party to exercise any of its rights under, or to enforce any provision of, this Agreement will not be deemed a waiver or forfeiture of such rights or ability to enforce such provision. If any provision of this Agreement is held by a court of competent jurisdiction to be illegal, invalid or unenforceable, that provision will be amended to achieve as nearly as possible the same economic effect of the original provision and the remainder of this Agreement will remain in full force and effect.
You agree that regardless of any statute or law to the contrary, any claim or cause of action arising of or related to use of aioBoard services or the Terms of Service must be filed within one (1) year after such claim or cause of action arose or be forever barred.
This Agreement shall be governed by and construed under the laws of the State of New York, USA, as applied to agreements entered into and to be performed in New York by New York residents. The parties consent to the exclusive jurisdiction and venue of the courts located in and serving the Borough of Manhattan, in the City of New York, in the State of New York, USA.
This Agreement embodies the entire understanding and agreement between the parties respecting the subject matter of this Agreement and supersedes any and all prior understandings and agreements between the parties respecting such subject matter. aioBoard may change the terms of this Agreement at any time by posting modified terms on its website. This Agreement has been prepared in the English Language and such version shall be controlling in all respects and any non-English version of this Agreement is solely for accommodation purposes. Any and all rights and remedies of aioBoard upon Your breach or other default under this Agreement will be deemed cumulative and not exclusive of any other right or remedy conferred by this Agreement or by law or equity on aioBoard, and the exercise of any one remedy will not preclude the exercise of any other. The captions and headings appearing in this Agreement are for reference only and will not be considered in construing this Agreement. Notices to You may be made via either email or regular mail. The Service may also provide notices of changes to the Agreement or other matters by displaying notices or links to notices to You generally on the Service. All notices or other correspondence to aioBoard under this Agreement must be sent to the following electronic mail address for such purpose: support@aioBoard.com
Or the following physical address:
aioBoard, Inc.
20008 Jersey Ave. Lakewood, CA 90715 USA
323-739-8827
AMENDMENT TO aioBoard TERMS OF SERVICE APPLICABLE TO U.S. GOVERNMENT USERS/MEMBERS
If you are a government user or otherwise accessing or using any aioBoard service in a government capacity, this Amendment to aioBoard Terms of Service applies to you.
The revised privacy policy will be effective starting on May 21, 2018
Your privacy is important to us, and so is being transparent about how we collect, use, and share information about you. This policy is intended to help you understand:
This Privacy Policy covers the information we collect about you when you use our products or services, or otherwise interact with aioBoard (for example, attending aioBoard events), unless a different privacy policy is displayed. This policy also explains your choices about how we use information about you. Your choices include how you can object to certain uses of information about you and how you can access and update certain information about you. If you do not agree with this policy, do not access or use our Services or interact with any other aspect of our business.
When we refer to "aioBoard," "we," or "us" in this policy, we mean aioBoard, Inc., which controls the information aioBoard collects when you use the Services. aioBoard offers collaborative tools, including our web, desktop, and mobile products, which help you stay organized and communicate with others. We also own and operate a number of websites and offer related services, like support. We refer to all of these products, together with our other services and websites as "Services" in this policy.
We collect information about you when you provide it to us, when you use our Services, and when other sources provide it to us, as further described below.
We collect information about you when you input it into the Services or otherwise provide it directly to us.
We collect information about you when you use our Services, including browsing our websites and taking certain actions within the Services.
We receive information about you from other Service users, from third party services, from the Senarysoft product family and related companies, and from our business and channel partners.
How we use the information we collect depends in part on which Services you use, how you use them, and any preferences you have communicated to us. Below are the specific purposes for which we use the information we collect about you.
We make collaboration tools, and we want them to work well for you. This means sharing information through the Services and with certain third parties. We share information we collect about you in the ways discussed below, including in connection with possible business transfers, but we are not in the business of selling information about you to advertisers or other third parties.
When you use the Services, we share certain information about you with other Service users.
We share information with third parties that help us operate, provide, improve, integrate, customize, support and market our Services.
We share information we collect with affiliated companies and, in some cases, with prospective affiliates. Affiliated companies are companies owned or operated by Senarysoft. The protections of this privacy policy apply to the information we share in these circumstances.
We use data hosting service providers in the United States to host the information we collect, and we use technical measures to secure your data. While we implement safeguards designed to protect your information, no security system is impenetrable and due to the inherent nature of the Internet, we cannot guarantee that data, during transmission through the Internet or while stored on our systems or otherwise in our care, is absolutely safe from intrusion by others. We will respond to requests about this within a reasonable timeframe.
How long we keep information we collect about you depends on the type of information, as described in further detail below. After such time, we will either delete or anonymize your information or, if this is not possible (for example, because the information has been stored in backup archives), then we will securely store your information and isolate it from any further use until deletion is possible.
You have certain choices available to you when it comes to your information. Below is a summary of those choices, how to exercise them and any limitations. We will respond to requests about this within a reasonable timeframe.
You have the right to request a copy of your information, to object to our use of your information (including for marketing purposes), to request the deletion or restriction of your information, or to request your information in a structured, electronic format. Below, we describe the tools and processes for making these requests. You can exercise some of the choices by logging into the Services and using settings available within the Services or your account. Where the Services are administered for you by an administrator (see "Notice to End Users" below), you may need to contact your administrator to assist with your requests first. For all other requests, you may contact us as provided in the Contact Us section below to request assistance.
Your request and choices may be limited in certain cases: for example, if fulfilling your request would reveal information about another person, or if you ask to delete information which we or your administrator are permitted by law or have compelling legitimate interests to keep. Where you have asked us to share data with third parties, for example, by enabling a Power-Up, you will need to contact those third-party service providers directly to have your information deleted or otherwise restricted. If you have unresolved concerns, you may have the right to complain to a data protection authority in the country where you live, where you work or where you feel your rights were infringed.
We collect information globally and primarily store that information in the United States. We transfer, process and store your information outside of your country of residence, to wherever we, Senarysoft or our third-party service providers operate for the purpose of providing you the Services. Whenever we transfer your information, we take steps to protect it.
aioBoard, Inc. and the U.S.-based Senarysoft corporate affiliates (Senarysoft, Inc., Senarysoft Network Service, Inc., and Dogwood Labs, Inc.) participate in and comply with the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks and the Privacy Shield Principles regarding the collection, use, and retention of information about you that is transferred from the European Union or Switzerland (as applicable) to the U.S. We ensure that the Privacy Shield Principles apply to all information about you that is subject to this privacy policy and is received from the European Union, the European Economic Area, and Switzerland.
Under the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks, we are responsible for the processing of information about you we receive from the EU and Switzerland and onward transfers to a third party acting as an agent on our behalf. We comply with the Privacy Shield Principles for such onward transfers and remain liable in accordance with the Privacy Shield Principles if third-party agents that we engage to process such information about you on our behalf do so in a manner inconsistent with the Privacy Shield Principles, unless we prove that we are not responsible for the event giving rise to the damage.
To learn more about the Privacy Shield Program, and to view our certification, please visit our public Privacy Shield listing.15
We encourage you to contact us as provided below should you have a Privacy Shield-related (or general privacy-related) complaint. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider16 (free of charge). Through this third-party dispute resolution provider, we have also committed to cooperating and complying with the information and advice provided by an informal panel of data protection authorities in the European Economic Area and/or the Swiss Federal Data Protection and Information Commissioner (as applicable) in relation to unresolved complaints (as further described in the Privacy Shield Principles). You may also contact your local data protection authority within the European Economic Area or Switzerland (as applicable) for unresolved complaints.
Under certain conditions, more fully described on the Privacy Shield website,17 including when other dispute resolution procedures have been exhausted, you may invoke binding arbitration.
We are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).
Our products are intended for both personal use and use by organizations. Where the Services are made available to you through an organization (e.g. your employer), that organization is the administrator of the Services and is responsible for the end-users and/or Service sites over which it has control. If this is the case, please direct your data privacy questions to your administrator, as your use of the Services is subject to that organization's policies. We are not responsible for the privacy or security practices of an administrator's organization, which may be different than this policy.
Even if the Services are not currently administered to you by an organization, if you are a member of a team administered by an organization, or if you use an email address provided by an organization (such as your work email address) to access the Services, then the administrator of that team or the owner of the domain associated with your organizational email address (e.g. your employer) may assert administrative control over your account and use of the Services at a later date. You will be notified if this happens.
Board, team, and enterprise administrators are able to restrict your access to and privileges within the respective board, team or enterprise the administrator controls. In some cases, enterprise administrators can also:
If you do not want an administrator to be able to assert control over your account or use of the Services, you should deactivate your membership with the relevant board, team or enterprise or remove any email addresses containing a domain owned or controlled by the administrator entirely from your account. Once an administrator asserts control over your account or use of the Services, you may no longer be able to withdraw membership or change the email address associated with your account without administrator approval.
Please contact your organization or refer to your administrator’s organizational policies for more information.
The Services are not directed to individuals under 16. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete such information. If you become aware that a child has provided us with personal information, please contact our support services.18
We may change this privacy policy from time to time. We will post any privacy policy changes on this page and, if the changes are significant, we will provide a more prominent notice by adding a notice on the Services homepages, login screens, or by sending you an email notification. We will also keep prior versions of this Privacy Policy in an archive for your review. We encourage you to review our privacy policy whenever you use the Services to stay informed about our information practices and the ways you can help protect your privacy.
If you disagree with any changes to this privacy policy, you will need to stop using the Services and deactivate your account(s), as outlined above.
Your information is controlled by aioBoard, Inc. If you have questions or concerns about how your information is handled, please direct your inquiry to aioBoard Inc., as set forth below:
aioBoard
Footnotes:
In order to fulfill our obligations to copyright owners, aioBoard complies with the Digital Millennium Copyright Act (“DMCA”). This policy sets out how we do that, including steps copyright owners should take if they believe that their copyrights have been infringed.
If you are a copyright owner, or authorized to act on behalf of one, and you believe that the copyrighted work has been copied and placed on aioBoard in a way that constitutes copyright infringement, please deliver a written DMCA Notice to our Designated DMCA Agent at the contact information provided below.
aioBoard, Inc.
ATTN: Nikko Erick L. Reyes
20008 Jersey Ave. Lakewood, CA 90715 USA
323-739-8827
dmca@aioBoard.com
Any person who knowingly misrepresents that material or activity is infringing may be subject to liability for damages. Nothing in this policy constitutes legal advice. You may want to seek the advice of legal counsel before submitting a DMCA notice.
In accordance with the DMCA and other applicable law, it is aioBoard’s policy, in appropriate circumstances and at our discretion, to disable and/or terminate the accounts of users who infringe or repeatedly infringe the rights of others or otherwise post unlawful content.
Please note that this policy is only for notifying aioBoard of claims that copyrighted material has been infringed. For issues other than copyright infringement, or for questions about these or any other aioBoard terms or policies, please email us at contact@senarysoft.com
aioBoard is PCI-DSS certified and complies with Privacy Shield. aioBoard is not itself ISO27001 or SOC certified—however, aioBoard receives and reviews its cloud providers’ SOC1 and SOC2 reports every 6 months under NDA.
Automated scans of aioBoard's production site are conducted a minimum of every 7 days. All changes are peer reviewed and vulnerability and security lists are actively monitored for CVE and other vulnerability disclosures with appropriate actions taken. A penetration test is commissioned annually, with all findings mitigated as appropriate. We also maintain an active bug bounty program on HackerOne.
As a general matter, issues that come to our attention through penetration tests, or other means, are fixed as quickly as reasonably possible.
aioBoard production services are hosted on Amazon Web Services’ (“AWS”) EC2 platform. The physical servers are located in AWS’s secure data centers. From Amazon’s documentation:
AWS has achieved ISO 27001 certification and has been validated as a Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS). We undergo annual SOC 1 audits and have been successfully evaluated at the Moderate level for Federal government systems as well as DIACAP Level 2 for DoD systems.
Further information on the security of AWS EC2 data centers is available directly from Amazon1.
All user content is stored within US regions of AWS and Google Cloud Storage ("GCS"). aioBoard’s production environment is hosted on an AWS EC2 platform. User content can also be found in aioBoard backups, stored in AWS EC2, S3, Glacier, and GCS.
We currently do not offer customers the option of hosting aioBoard on a private server, or to otherwise use aioBoard on a separate infrastructure.
Separate and distinct production, staging, and development environments are maintained, and production data is not replicated outside of the production restricted environments.
Authorized and trained members of aioBoard's SRE and Server Engineering teams who have undergone background checks authenticate to the VPN using unique strong passwords and TOTP based 2FA and then only access the production environment via ssh terminal connections using passphrase protected personal RSA certificates. An IDS system is in place on all production servers, which includes realtime monitoring and alerting of any changes to the production system files or configuration and anomalous security events. For those authorized and trained members of the operations team with access to the production system, any workstations running Windows or OS X used for ssh terminal access to the production environment must be running current and active anti-virus software. Customer data is not replicated onto employee workstations or mobile devices. Users of aioBoard can access data via mobile apps.
aioBoard uses Akamai for DDoS protection and Web Application Firewall service. A host based IDS is in place on production servers with real time monitoring and alerting on abnormal behavior or system configuration changes. AWS does not provide a SPAN port for reliable traditional network based IDS.
SAML 2.0 SSO is supported for aioBoard Enterprise customers. All customers can enable 2FA on their accounts or use Google OAuth. If SSO or OAuth is used to access aioBoard, aioBoard will inherit the login security settings in the user's IdP or Google account.
If logging in directly to aioBoard using a username or email and password, aioBoard requires a minimum of 8 characters. Repeated failed login attempts trigger a 30 second lock before a user can retry. Passwords are stored in a hashed form and will never be sent via email—upon account creation and password reset, aioBoard will send a link to the email associated with the account that will enable the user to create a new password.
Password complexity and session length requirements cannot be customized within the app. However, these can be set within an IdP for an SSO-enforced team.
All customer data is considered highly sensitive and protected and access is least privilege. Only authorized and trained members of the aioBoard team have direct access to production systems and user data. Those who do have direct access to data are only permitted to view it in aggregate or for troubleshooting purposes. User data is only viewed by aioBoard employees for troubleshooting purposes when consent has expressly been provided ahead of time by the account owner or team administrator.
We maintain a list of members of the aioBoard team with access to the production environment. These members undergo criminal background checks and are approved by the VP of Engineering. Another list allows all relevant roles to access code, as well as the development and staging environments. These lists are reviewed quarterly and on role change.
Trained members of the aioBoard customer support team have case-specific, limited access to user data through restricted access customer support tools. Customer support team members cannot review user-generated content without an express and revocable grant of permission. When a aioBoard user submits a support ticket, they have the option of authorizing the customer support team to view their data. The aioBoard Support team will only receive access to the account if it is explicitly granted by the user, either by selecting the "Give aioBoard support staff temporary access to your account" option when submitting a help request, or by clicking a link sent to the user's email by the aioBoard Support team. Only after authorization has been provided by the account owner will members of the support team use their account view tool to view the account owner’s data. The account owner can revoke access at any time.2 Upon role change or leaving the company, or before firing, the production credentials of aioBoard employees are deactivated, and their sessions are forcibly logged out. From there, all accounts are removed or changed.
Select customer data in very limited cases is shared only with third parties service providers acting as our agent (a user's email address for an email delivery provider, for example) and in strict compliance with signed service agreements.
Customer data is never to be replicated outside of the production environment and is never to be replicated onto employee workstations. Because of this, aioBoard relies on AWS for physical security compliance. aioBoard's production services are hosted on Amazon Web Services’ (“AWS”) EC2 platform. The physical servers are located in AWS’s secure data centers. Production critical data is never to be stored on physical media outside of the cloud provider's production environments. From Amazon’s documentation:
AWS has achieved ISO 27001 certification and has been validated as a Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS). AWS undergo annual SOC 1 audits and have been successfully evaluated at the Moderate level for Federal government systems as well as DIACAP Level 2 for DoD systems.
Further information on the security of AWS EC2 data centers is available directly from Amazon.3
Strict firewall rules prohibit access to necessary ports for the usage of the service (e.g., 443), to ensure limited access to the production environment to our VPN network and authorized systems. The corporate network has no additional access to the production environment, with authorized employees still required to connect to the VPN in order to access any special systems or environments.
Production customer data is never to be stored on employee workstations or removable media. Employee devices are required to time out and lock after a maximum of ten minutes of inactivity. aioBoard does not have a clean desk policy.
aioBoard uses industry standard Transport Layer Security (“TLS”) to create a secure connection using 128bit Advanced Encryption Standard (“AES”) encryption. This includes all data sent between the web, iOS, and Android apps and the aioBoard servers. There is no non-TLS option for connecting to aioBoard. All connections are made securely over https.
Data drives on servers holding user data use full disk, industry-standard AES encryption with a unique encryption key for each server. For Enterprise customers, aioBoard guarantees that file attachments uploaded after June 3, 2015 will be encrypted at rest using industry standard AES encryption. File attachments to aioBoard cards are stored in Amazon’s S3 service. Each attachment is assigned a unique link with an unguessable, cryptographically strong random component, and are only accessible using a secure HTTPS connection. File attachments uploaded after June 3, 2015 are encrypted using Amazon S3 server side 256bit AES encryption. The encryption, key management, and decryption process is inspected and verified internally by Amazon on a regular basis as part of their existing audit process. At an Enterprise customer’s request, attachments uploaded prior to June 3, 2015 can be retroactively encrypted within Amazon S3. All backups are encrypted with AES encryption.
To be clear, while customer data is never to be stored on the workstations or removable media of aioBoard employees, some data may be stored in an unencrypted form on the phones of users who are using the aioBoard iOS and Android apps. For both operating systems, if someone can get around the native operating system sandboxing because of a compromised or rooted device or the like, additional measures that could be taken within the application could be easily circumvented at that point.
Encryption keys for aioBoard attachments, stored in S3, are managed by Amazon. The encryption, key management, and decryption process is inspected and verified internally by Amazon on a regular basis as part of their existing audit process. aioBoard-managed keys are rotated upon relevant changes of roles or employment status. Encryption keys are not stored outside of the production backup environment and are managed by the aioBoard Site Reliability Engineering team. Backups are of the entire data set and so are encrypted using a shared key.
Production customer data is never to be replicated outside of the production cloud environments and is never to be stored on employee workstations or removable media. On termination of a aioBoard Enterprise contract, and at the request of the customer, the data belonging to the Enterprise teams will be completely removed from the live production database and all file attachments uploaded directly to aioBoard will be removed within 30 days. The team’s data will remain in encrypted aioBoard database backups until those backups fall out of the 90-day backup retention window and are destroyed in accordance with aioBoard’s data retention policy. In the event that a database restore is necessary within 90 days of a requested data deletion, the aioBoard operations team will re-delete the data as soon as reasonably possible after the live production system is fully restored.
All changes to the production system, be they code or system configuration changes, require review prior to deployment to the production environment. Thousands of automated unit tests are run against all production code prior to deployment, as well as regularly conducted automated vulnerability scans and commissioned penetration tests. All changes are tested in a staging environment prior to deployment to production. Patches to the web client are deployed on a rolling basis, usually several times per week. Production servers are managed via a centralized configuration system. All system changes are peer reviewed and patches are deployed as relevant to their level of security and stability impact, with critical patches able to be deployed well within 24 hours of availability as appropriate.
aioBoard restricts access and maintains separate lists of relevant roles with access to source code, development, staging, and production environments. These lists are reviewed quarterly and on role change. We use source code management tools and repositories.
All production servers are running a LTS (Long Term Support) distribution of their operating system to ensure timely updates are available. CVE lists and notifications are actively monitored and any systems can be patched in a timeline relevant to the severity of the issue. A centralized configuration system is used for the management of production servers, and when needed a patch can be deployed within hours of its availability.
A full list of the open-source libraries used in aioBoard can be found on aioBoard's "open source libraries" page.4
Actions which manipulate data are stored within the aioBoard service and are available for the client/user (e.g., when viewing the action history on a card, board, or team). This information is available within the app unless a card is deleted (not archived), at which point it cannot be restored.
The following information is available internally:
All API calls and application logs are kept for at least 30 days without sensitive information (no full user tokens, no user generated content), and available only for authorized employees as required by their role for monitoring of the aioBoard service to ensure service availability and performance and to prevent abuse. Some anonymous analytical information including browser user agent, geographical location based on IP, etc, is collected along with usage events (e.g., a list was created) with no user generated content (no list names, card content) for analytical purposes on usage of our service.
Application logs are centrally collected in an ElasticSearch cluster for a minimum of 30 days for monitoring and analysis. Security, authentication, and Intrusion Detection System (IDS) logs are additionally retained in S3 CloudWatch buckets with a 12 month lifecycle to ensure retention.
While some assets are not owned by a specific individual, ownership and maintenance of the confidentiality, integrity, and availability of our systems is distributed amongst the Site Reliability Engineering and Operations teams. Assets are transferred upon role change or leaving the company.
Upon account creation, aioBoard users are asked for a username, full name, and email, though these do not need to be verified. aioBoard makes no assumptions about the types of data that a given customer may choose to store within its service. aioBoard is a visual collaboration tool that supports organizing of data into cards, lists, and boards and can include attachments, but the specific nature of what is stored is up to the client.
aioBoard validates files for well-formedness and the like, however, we have explicitly designed the product to support any type of content users may choose to store within the aioBoard service. All attachments are stored and accessed from a completely separate domain to prevent any potential access to user data, cookies, etc. As an example, aioBoard very well could have a security researcher storing examples of malicious XSS attacks as attachments on their aioBoard board, and aioBoard would be able to support that without risk to the codebase underpinning the actual aioBoard Service.
Admins for an Enterprise account will be set via your account manager. Admin, regular, and read-only (“observer”) roles can be assigned within the app itself.
It is not possible to limit the geolocations allowed to access data within aioBoard. Data can be accessed by users who have access to such data within the app from any geolocation. All access to user data is via the API which includes strict authorization checks. All server role interactions go through strict security group/firewall rules which limits access to authorized instance roles on authorized ports required for them to fulfill their role.
Power-Ups cannot be restricted within a team. Power-Ups which connect aioBoard to other services (such as Evernote or Dropbox) will require authentication with an existing account in that service before the Power-Up is active. If working within a corporate environment, the domain used to authenticate that account can be blocked in your environment's firewall.
Data entered into aioBoard is backed up regularly. All backups are encrypted and stored at multiple offsite locations to ensure that they are available in the unlikely event that a restore is necessary.
Files uploaded to aioBoard as card attachments are not backed up on the same schedule, and instead rely on Amazon S3’s internal redundancy mechanism.
Files associated with aioBoard cards from a supported cloud storage provider are subject to the storage provider’s own backup procedures and policies and are not included in the aioBoard backup procedures.
All backups are immediately encrypted with 256-bit AES encryption using GNU Privacy Guard (“GPG”) with a password-protected symmetric cipher. Encrypted backups can only be decrypted by members of the aioBoard operations team who have received training and have been authorized to decrypt the backups.
Because user data is on a shared infrastructure, it is not uniquely identifiable. As such, it is not possible for us to recover a subset of that information from backups. If a user is particularly concerned with maintaining a complete record of their information in aioBoard, we suggest you frequently export your data or use our API5 to connect a DLP tool to aioBoard.
A rolling live replica of aioBoard’s primary database is constantly being taken on a 1-hour delay. Additionally, a full backup snapshot of the primary database is taken once every 24 hours.
All aioBoard backups are retained on the following schedule and at the following locations:
Only authorized members of the aioBoard operations team have access to the backup locations, so that they are able to monitor the performance of the backup processes, and in the very unlikely event that a restore becomes necessary. After 90 days, the encrypted backup files are destroyed.
Attachments directly uploaded to aioBoard are handled differently than the primary database backups. To backup file attachments, aioBoard primarily relies on S3’s internal redundancy mechanism, which Amazon states provides 99.999999999% yearly data durability. Attachments are also backed up to Google Cloud Storage for additional redundancy.
aioBoard board data is available for export by board members in JSON format via the aioBoard REST API. File attachments can be individually retrieved directly from Amazon S3 using the file’s unique hyperlink.
aioBoard Business Class and Enterprise editions offer a simplified data export process for all team data and attachments. Each Business Class and Enterprise team includes one-click export of all Boards within the team. Optionally, file attachments uploaded directly to aioBoard can be included in the export file. Within the export, each board’s data is included in both JSON and Comma Separated Values (“CSV”) format.
The aioBoard operations team has designed systems to keep the service running even if the underlying infrastructure experiences an outage or other significant issue. Every critical aioBoard service has a secondary, replicated service running simultaneously with mirrored data in a different AWS availability zone than the primary server. Additionally, each database server has a replicated service running in a third availability zone with data that is mirrored on a one hour delay.
Because it is critical to have reliable access to your business’ important projects and data, aioBoard has been architected to survive a single availability zone outage without significant service interruptions.
In the unlikely event that two Amazon EC2 availability zones have long-term service interruptions, aioBoard has been designed to recover with limited service interruption and a maximum of 1 hour of data loss.
In the even more unlikely event that aioBoard’s entire AWS EC2 region is irrecoverably lost, aioBoard will restore servers using automated configuration systems. In this event, user data would be recovered from backups as quickly as possible, with no more than of 24 hours of data loss.
aioBoard's Site Reliability Team regularly tests the various components of its Business Continuity architecture to ensure continued operations. aioBoard does not currently run anything like Chaos Monkey.
aioBoard does not have an SLA or credit policy. aioBoard had over 99.99% uptime in 2015 and 2016, and any downtime is documented at aioBoard's status page.6
A aioBoard problem impacting a aioBoard Enterprise customer will be assigned a Severity Level and handled according to the resolutions in Table 1.
Table 1: Incidents and Response Severity Levels:
Level
Description
Resolution
Examples
Severity 1
aioBoard is not available or is unusable.
Work begins within 1 hour from report, temporary resolution within 4 hours, final resolution within 7 hours.
The site is not responding; all text on the site is being translated into elven runes.
Severity 2
Service or performance is substantially degraded in a way that prevents normal use.
Work begins within 2 hours from report, temporary resolution within 48 hours, final resolution within 14 days.
Search only finds cards with the search terms in the title; aioBoard cannot be used with the new Firefox version that came out today.
Severity 3
A service not essential to aioBoard’s main functionality is unavailable or degraded.
Work begins within 72 hours from report, temporary resolution within 7 days, final resolution within 30 days.
Activity indicators are not showing who is active; updates are taking 30 seconds to propagate to other board viewers.
Severity 4
Minor or cosmetic issues with aioBoard services, and all feature requests.
Resolution at aioBoard team’s discretion.
Board background images aren’t scaling properly; feature request for dependencies between cards.
aioBoard does not have a centrally managed anti-virus solution. For those authorized and trained members of the operations team with access to the production system, any workstations running Windows or OS X used for ssh terminal access to the production environment must be running reputable, current, and active anti-virus software with real-time monitoring and at-least-daily updates.
Members of aioBoard's technical staff with access to the production environment may choose to run linux as their workstation operating system. Given the inadequate state of linux antivirus software and the lack of prevalence of viruses for that platform, policy does not require those workstations to run antivirus. All of the existing controls, including restricting access from those workstations to the production environment via ssh terminal connections only and with no replication of user data onto those workstations, still apply.
aioBoard's linux servers run an Intrusion Detection System (IDS) which includes scanning for common rootkit signatures and File Integrity Monitoring which alerts on any changes to the system configuration and operating system files.
Many of aioBoard’s employees work remotely. Customer data is never to be replicated outside of the production environment, which is stored within AWS' secure servers. Strict firewall rules are in place thus limiting access to the production environment to our VPN network and authorized systems.
Authorized and trained members of aioBoard's SRE and Server Engineering teams who have undergone background checks authenticate to the VPN using unique strong passwords and TOTP based 2FA and then only access the production environment via ssh terminal connections using passphrase protected personal RSA certificates.
The corporate network has no additional access to the production environment, with authorized employees still required to connect to the VPN in order to access any special systems or environments.
Security awareness and customer data access policies are covered during employee onboarding as appropriate to the role and employees are updated as relevant policies or practices change. Employees also sign a Confidential Information and Inventions Agreement.
In the event that a security policy is breached by an employee, aioBoard reserves the right to determine the appropriate response, which may include termination.
All employees undergo an extensive interview process before hiring. Employees with direct access to the production environment undergo a criminal background check. Other employees may undergo a check depending on their role (academic for legal roles, credit for finance, etc). Appropriate NDAs are in place with third parties as appropriate.
Employees are required to enforce 2FA when available and use a password manager with random, secure passwords. Authorized employees access the production environment by authenticating to the VPN using unique strong passwords and TOTP based 2FA and then only via ssh terminal connections using passphrase protected personal RSA certificates.
When it is necessary to perform planned maintenance on aioBoard services, the aioBoard operations team will perform the work during one of two scheduled weekly maintenance windows. We will make reasonable efforts to announce maintenance procedures that could potentially impact users of aioBoard on the @senarysoft Twitter account7 at least 24 hours prior to the event, and via an in-app announcement at least 30 minutes prior to the event.
These windows have been selected with the goal of minimizing service downtime, slowness, or other impact to the people and businesses that rely on aioBoard.
We do our best to make outages as short as possible. Additionally, our maintenance schedule will frequently be evaluated to ensure that we keep user impact as low as reasonably possible. Should we need to reschedule these windows, the updated schedule will be announced on our Status Blog and Twitter accounts with reasonable advance notice.
Due to unforeseen events, we may have to infrequently perform unplanned maintenance on aioBoard infrastructure or software components. This maintenance might cause some or all of the aioBoard services to be inaccessible by our users for a period of time. It is our goal to do this as infrequently as possible. Any unplanned or emergency maintenance will be announced on the aioBoard Status Blog and in-app with as much advance notice as reasonably possible. As with planned maintenance, we do our best to minimize disruption caused by service outages.
It is not possible for us to customize the maintenance window, as our users are on a shared infrastructure. However, we've used this maintenance window extremely rarely—about once a year, for under 15 minutes each time.
Footnotes: