Security and privacy at Pendula

Endpoint protection

All corporate devices are centrally managed and are equipped with mobile device management software and anti-malware protection. We use MDM software to enforce secure configuration of endpoints, such as disk encryption, screen lock configuration, and software updates. Pendula uses device trust to enforce security standards on its end points before authentication to critical systems is allowed.

Secure remote access

Pendula secures remote access to internal resources using Teleport, an identity aware proxy that allows short term access to critical resources. All access is secure via Okta with device trust and is audited. 

Security education

Pendula provides comprehensive security training to all employees upon onboarding and annually through Knowbe4. All new employees attend a mandatory live onboarding session to understand Pendula’s key security principles. All engineers also attend mandatory developer security training.

Pendula’s security team shares regular security updates with the Pendula team and role specific updates for key departments.

Identity and access management

Pendula uses Okta to secure our identity and access management. Pendula enforces the use of phishing-resistant authentication factors such as device trust.Pendula employees are granted access to applications based on their role, and are deprovisioned upon termination of their employment.

Vendor security

Pendula uses a risk-based approach to vendor security. Factors which influence the inherent risk rating of a vendor include:

• Access to customer and corporate data
• Integration with production environments
• Potential damage to the Pendula brand

Once the inherent risk rating has been determined, the security of the vendor is evaluated in order to determine a residual risk rating and an approval decision for the vendor.