Security and Privacy Overview

At CKEditor, we care deeply about security and privacy. Our Cloud Services are built on a strong, flexible system that protects your data with advanced security measures and constant monitoring. We are certified to SOC 2 Type 2 standards, which means we follow the industry’s best practices to keep your data secure, available, and private. We also believe in being open and honest, so we keep you informed about our operations.

CKEditor Cloud Services uses Amazon Web Services (AWS) for hosting. AWS is a well-known and trusted cloud platform that offers strong security, the ability to grow efficiently, and the ability to follow important rules. By choosing AWS, we ensure our services run on a safe and strong system. This helps us provide our users with the best performance, reliability, and data protection.

We operate within the US East (Northern Virginia) and European (Frankfurt) AWS regions. The users residency and local legal solutions can affect the choice between these two.

We use AWS to provide services, such as:

• AWS ECS to manage containerized applications. ECS provides a highly scalable and reliable way to orchestrate workloads, ensuring automatic scaling and distribution of resources to handle traffic spikes.

• AWS ALB to efficiently distribute traffic. This helps maintain performance and availability, even if some instances experience heavy load or failure.

• AWS RDS – an engine for databases that provide automated backups, multi-AZ replication, and point-in-time recovery.

• AWS Elasticache to cache in-memory to ensure faster response times for our users.

• AWS SNS/SQS for reliable message queuing, enabling asynchronous communication in the system.

AWS provides a wide range of built-in security services that enhance our platform’s protection:

• AWS GuardDuty actively protects our system. It always watches for suspicious or unauthorized activity in our AWS environment, helping us quickly spot and respond to any possible security threats.

• AWS Security Hub is a centralized security monitoring and compliance check across the entire AWS infrastructure.

• AWS AppConfig manages dynamic configuration changes across applications, allowing us to safely and quickly deploy configuration updates without impacting the system’s security or stability.

• AWS Config continuously monitors and assesses the configuration of our AWS resources to ensure compliance with internal security policies and best practices. AWS Config helps us track configuration changes and identify resources that may be non-compliant.

• AWS CloudTrail records and logs all API activity and changes across our AWS infrastructure, providing complete visibility into user actions for auditing and incident response purposes. CloudTrail ensures a comprehensive audit trail of every action taken on our resources.

• AWS Certificate Manager (ACM) automatically manages and provisions SSL/TLS certificates to secure our application traffic. This ensures all communication is encrypted, providing secure connections between the user and our services.

• AWS Secrets Manager protects sensitive data, such as all configurations and database credentials, by securely storing and managing access to secrets.

• AWS Key Management Service (KMS) handles cryptographic keys for encrypting data, ensuring strict control and compliance with industry standards.

• AWS CloudWatch collects and monitors real-time logs, performance metrics, and application data to detect security and operational anomalies.

AWS complies with a wide range of global security and compliance certifications, including SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017, ISO 27018, and GDPR. CKEditor Cloud Services benefits from these certifications, inheriting the strong security posture of the AWS cloud.

All components of CKEditor Cloud Services are hosted on an AWS VPC, which provides network isolation. Public access is limited to load balancers, and all other components are protected behind strict security controls such as Security Groups, Network Access Control, and VPN access.

To control the traffic allowed into and out of our instances, we rely on AWS Security Groups. These groups are configured with strict and restrictive firewall rules, ensuring only authorized traffic can interact with our systems. This approach significantly enhances the security of our platform. Network access control lists provide an additional security layer operating on subnets/networking level.

We use AWS WAF to protect our system from common web attacks. This includes things like SQL injection and cross-site scripting (XSS). The WAF constantly updates its protection rules to defend against new threats.

To defend against Distributed Denial of Service (DDoS) attacks, we use AWS Shield Advanced. This managed DDoS protection service protects our web applications at network and application levels. AWS CloudFront and Route 53 also provide additional layers of DDoS mitigation by distributing traffic and reducing the attack surface.

Ensuring high availability and resilience is fundamental to CKEditor Cloud Services.

Our services are deployed across multiple AWS availability zones. This means if one location has problems, we can quickly switch to another. This keeps our service running smoothly without interruptions.

Databases are continuously replicated across multiple availability zones, providing redundancy and fault tolerance. When an availability zone becomes unavailable, the system automatically switches to another.

CKEditor Cloud Services automatically backs customer data with point-in-time recovery capabilities for up to 7 days. Backups are securely encrypted and stored in multiple AWS locations, ensuring the highest levels of redundancy and data protection.

We have a thorough plan to quickly get our systems back up and running if something goes wrong. We regularly test this plan to make sure it works well. This helps us keep our services available despite a big problem.

Our infrastructure is designed to deliver a 99.99% uptime SLA, supported by AWS’s highly reliable services.

Data security is at the heart of CKEditor Cloud Services, and we implement strong encryption and access control measures to protect sensitive information.

All data is encrypted using AES-256 at rest, and TLS 1.2+ encryption is enforced for all communications in transit. This ensures that data is securely transmitted and stored without exposure to unauthorized access.

We isolate customer data using separate encryption keys for each customer and environment. This ensures that customer data is fully segregated and protected from unauthorized access.

Our encryption keys are managed using AWS Key Management Service (KMS), which ensures that all cryptographic operations meet the highest security standards.

Access control is tightly enforced across CKEditor Cloud Services, ensuring only authorized personnel can access critical systems and data.

Permissions are assigned based on roles, ensuring that users have access only to the data and systems necessary for their job functions. Regular access reviews ensure that permissions remain appropriate over time.

We enforce MFA for all privileged access to the CKEditor Cloud Services infrastructure. This additional layer of protection ensures that even if credentials are compromised, unauthorized access is prevented.

Internal access to systems is centralized using Google SSO, minimizing password management risks and improving security.

We perform regular access audits, logging all access attempts and monitoring for any suspicious activity. All changes to access rights are logged and can be audited for compliance and security purposes.

At CKEditor, we follow a secure Software Development Life Cycle (SDLC), ensuring security is embedded in every stage of development.

All changes to our code are carefully checked by engineers. This helps catch any potential security problems before they can affect our live system. We do this to make sure our code is safe and works well.

We use static code analysis tools to scan code for vulnerabilities and insecure practices automatically. These scans ensure that every line of code adheres to security standards (for example OWASP Top Ten).

All code is subject to automated unit testing and integration testing to validate its functionality and security.

Our QA team conducts manual and automated testing on all updates before being deployed to production. This includes security testing, performance testing, and functional validation to ensure the application’s integrity and security.

Our CI/CD pipeline ensures that all deployments to production are automated and pass through multiple layers of security checks. Only code that meets strict security and performance criteria is allowed to be deployed.

We take a proactive approach to identifying and mitigating vulnerabilities across our systems.

We use automated tools to scan our infrastructure and applications for known vulnerabilities continuously. These scans reference the latest Common Vulnerabilities and Exposures (CVE) database.

We engage third-party security experts to perform annual penetration testing of our systems, identifying potential vulnerabilities and ensuring our security posture remains robust.

Our patch management policy ensures that security patches are applied promptly to mitigate potential risks. Critical patches are prioritized for immediate deployment, while non-critical updates are tested before implementation.

We continuously monitor our environment for security and performance, ensuring that any issues are swiftly identified and resolved.

Using AWS CloudWatch, AWS GuardDuty, AWS Security Hub we continuously monitor for security events, performance metrics, and operational anomalies. If suspicious activity is detected, automated alerts are generated for immediate investigation.

Any abnormal activity, such as unauthorized access attempts or unusual traffic patterns, triggers real-time alerts. Our team reviews these alerts to prevent potential incidents.

CKEditor Cloud Services has a clear plan for handling all security and reliability problems. This plan explains how we find, investigate, and fix issues. After each incident, we do a post-mortem analysis and review to determine why it occurred and improve our system to prevent similar incidents in the future.

We maintain detailed audit logs of all actions taken in production environments, ensuring transparency and accountability. Logs are securely stored and available for review during security investigations or audits.

To ensure high availability and a seamless user experience, CKEditor Cloud Services continuously tests and monitors its applications through real-user simulations.

We monitor key performance indicators (KPIs) such as network usage, CPU and memory utilization, latency request processing time, and more. All metrics are stored in Prometheus and Grafana. Any deviation from expected performance levels triggers alerts and investigations by our operations team.

We employ automated bots that simulate fundamental user interactions with the system regularly (every 10 minutes), continuously testing for performance, reliability, and potential issues. These bots help identify potential bottlenecks or problems before they impact customers.

As of January 2025, CKEditor Cloud Services is SOC 2 Type 2 certified, demonstrating our adherence to the highest security, availability, and confidentiality standards.

Our SOC 2 certification confirms that we have implemented robust security controls to protect customer data from unauthorized access, ensuring compliance with best industry practices.

We comply with key global privacy regulations, including GDPR, ensuring your data is handled with the utmost care and transparency.

CKEditor Cloud Services partners with trusted vendors to deliver reliable and secure services. We ensure all subprocessors comply with strict security and privacy requirements.

Our primary hosting provider is AWS, compliant with SOC 1, SOC 2, ISO 27001, and GDPR. AWS’s infrastructure provides a secure foundation for CKEditor Cloud Services, ensuring high availability and data security.

We perform annual reviews of all subprocessors to ensure they maintain compliance with industry standards and regulatory requirements, including SOC 2 and GDPR.

We operate within the US East (Northern Virginia) and European (Frankfurt) AWS regions.

The choice of a cloud region determines data residency and can help meet the legal requirements (such as GDPR compliance) and performance KPIs (by locating the services closer to your end users).

The table below offers a more detailed insight into differences between both locations and their effects on each Cloud Services service.

If you have any questions or concerns about CKEditor Cloud Services’ security policies and practices, please get in touch with our team at security@ckeditor.com.