All connections to HunchBuzz are secured via SSL/TLS. Any attempt to connect over HTTP is redirected to HTTPS.
API & DMZ
HunchBuzz has a secure API framework within a Demilitarized Zone (DMZ). Front-end code is separated from the core API providing a robust security layer, access to the API is strictly limited.
Securely hosted in a Private Cloud
HunchBuzz utilizes secure development best practices that integrate security reviews throughout design, prototype, and deployment. Hosted within a secured private cloud, the HunchBuzz platform is self-contained and cannot detect, interfere with or view any other platform within the hosting environment. This policy is managed at a layer not accessible to other platforms within the environment.
All customer and user data is stored in our Private Cloud with special security policies; above PCI (bank) standards. Services use a dynamic firewall and forwarder to connect to the database and memcache. These are network layer redirects routed directly to the services. It is not possible for any app within our Hosting provider to connect to our services–even if they were using hijacked credentials. Requests to our platform’s services are only allowed if they come from the HunchBuzz app, or else they are rejected.
A malicious instance within our hosting providers environment has no access to the layer where the redirect was created. Finally, a firewall and intrusion detection layer inspects and validates each request. This firewall is updated nightly to include the latest intrusion detection rules.
Limited Staff Access
HunchBuzz has strict rules and checks around who has access to the back-end. Only specific staff can have access to make changes and modifications, all access to the back end is logged.
Post content verification is a web application firewall. Post-like events such as spam, login credentials, hacking, XSS, SQL injection will be stopped in real-time.
Browser Integrity Check
Our network Scans HTTP headers abused by spammers and denies access. These checks also challenge visitors that do not have a standard web browser or user agent.
Detects and blocks common keywords used in comment spam, as well as attack signatures used in cross-site scripting attacks and SQL injections.