Security FAQ – Youreka Knowledge Base


Question	Answer
What infrastructure hosting options are available - SaaS / PaaS / Traditional client hosted on-prem? Give details including any cloud hosting partner that you work with and physical location of data centers.	SaaS. Youreka is a Salesforce-native application and runs on your Salesforce instance.
Can your solution be built on a virtual infrastructure? If so which components? Have you any reference sites running on virtual infrastructure?	Youreka is a Salesforce-native application and runs on your Salesforce instance.
Do you have standard tools for archiving of data (including identification of data sets and auto processing of regular jobs to keep data according to rules)?	You may use Salesforce data archiving tools.
Are any proprietary plugins and add-on components required to be installed on client devices? If so, please provide details.	Yes, the Youreka mobile application on end user devices.
Are any runtime libraries required for the solution to function (flash, Java etc.)? If so, please describe how your solution is kept current with the latest releases of these libraries.	No.
Is any 3rd party / open source software built within your solution? If so, please describe the impact this will have.	No.
Describe the back-up / restore functionality available within the application.	This functionality is covered by Salesforce due to Youreka being a Salesforce-native application that resides on your Salesforce instance.
Please describe the service level options for disaster recovery (RTO/RPO) and what system performance you guarantee after recovery. In the event of a crash, can the solution recover the auto saved documents/forms/transactions without interventions?	This functionality is covered by Salesforce due to Youreka being a Salesforce-native application that resides on your Salesforce instance.
Please describe the recommended technical architecture for availability and disaster recovery and describe SLAs.	This functionality is covered by Salesforce due to Youreka being a Salesforce-native application that resides on your Salesforce instance.
Describe how the application supports event / fault monitoring and end to end performance monitoring. How does the solution support consistent performance across countries? How are performance issues reported, investigated and addressed? Is there any continuous application monitoring to keep the application running at acceptable response times?	This functionality is covered by Salesforce due to Youreka being a Salesforce-native application that resides on your Salesforce instance.
What caps are applied against the platform in terms of data volume, logins etc., and what happens when these limits are breached?	Standard Salesforce limits and behavior apply. Youreka has a few specific limitations to be considered, which can be found in our limits documentation.
Please describe how you can scale the solution in the event of unexpected demand (concurrent users or queries).	This functionality is covered by Salesforce due to Youreka being a Salesforce-native application that resides on your Salesforce instance.
Describe the release management process you use, covering both security and functional patches. Detail the impact of upgrades of your solution on the solution availability and how this is impact minimized?	Youreka releases 4 versions of the application each year. Youreka subscribers determine if and when they would like to deploy an upgrade.
How would data be migrated in the event of relocating or re- hosting the service? (In the event that we need to extract all the data from the platform, how is this catered for?)	This functionality is covered by Salesforce due to Youreka being a Salesforce-native application that resides on your Salesforce instance.
Is it possible to link a transaction with an IT Service Management ticketing system (e.g. Remedy) to raise and/or update a ticket number associated with a service incident case ? Do you provide API's for integration between this product and others?	Yes, we would be happy to explore this with you.
Please indicate the geographical areas covered by your help desk support. During what time zones/working hours is this available?	Please ask us for our Service Level Agreement documentation.
Does the application provide context sensitive help?	Yes, Youreka provides guidance to end users to help them use the application more effectively.
What languages does the application support? Does it support Unicode?	Youreka templates can be designed in any language and presented to end users accordingly. Youreka's administrative UI provides guidance in English.
Can the full features of the application be accessed from an https session through a standard browser?	Yes, with the exception of Youreka's offline data capture capabilities, which is exclusively available with Youreka's mobile app.
Specifically confirm you are able to support IE 11 and Edge, and please detail any other browsers and versions you support. How does your software manage upgrades in supported browsers?	Youreka's desktop functionality is supported by the same browsers that Salesforce supports, which means IE 11, Edge, Firefox, Chrome, and Safari are all supported.
Confirm that your application is responsive to different form factors, e.g. smartphone, tablet, laptop etc.	Confirmed.
Is the application's functionality available both online as well as offline? If not, what are the limitations for working offline? How are updates synchronized when users have been working offline?	The application's functionality is available both online and offline. Offline functionality is supported by our mobile application. The ability to collect information, reference Salesforce records, and be guided through a form is all available offline. Users cannot utilize Youreka's Discoveries feature, or Salesforce Einstein while offline. Updates are synchronized when users come back online. When users find internet connectivity, the application presents them with a push notification where they can click through and sync information back to Salesforce.
What major operating systems do you support? Detail how you ensure the product remains compatible with all major versions.	We support the major versions of Windows and macOS that are still supported by Microsoft and Apple. Our application will operate on older versions, but we do not recommend running OS versions that are no longer supported by the OS vendor because security vulnerability patches are no longer being issued.
If you have a mobile app, please describe how the solution is kept up to date with new mobile OS releases (Android and iOS).	Youreka's quarterly releases are tested on previous, current and future (beta) versions of mobile operating systems to ensure compatibility.
Describe how the look and feel can be customized to reflect corporate brand guidelines. What are the implications of these changes on upgrades?	Youreka provides WYSIWYG tools for modifying the look and feel and also offers the ability to apply custom style sheets to take branding, look and feel even further.
If deployed, what level of business end user "self-service" is possible without IT involvement? How much can the system be reconfigured without an IT request ?	Youreka is designed to position business end users to administer new version of templates using intuitive drag and drop tools.
Are there any known issues with antivirus or end point protection products?	No.
How do you ensure that application is secure (source code, infrastructure, application, DDOS protection? logging/audit)?	With Youreka being a Salesforce-native application that is available via the Salesforce AppExchange, each release of Youreka is required to pass Salesforce's security review, a code scan conducted by Checkmarx, automated regression testing, and manual testing procedures.
Will we be allowed to perform vulnerability tests on the solution, or are results of tests provided by the vendor?	With Youreka being deployed to your Salesforce instance you may conduct vulnerability testing on your own Salesforce instance.
Please describe the encryption methods used, both for data at rest and data in transit.	https://help.salesforce.com/articleView?id=security_pe_vs_classic _encryption.htm&type=5
If there is a breach/data theft, what is the process for reporting such back to us?	This functionality is covered by Salesforce due to Youreka being a Salesforce-native application that resides on your Salesforce instance.
Can application logs can be integrated with SIEM solutions?	This functionality is covered by Salesforce due to Youreka being a Salesforce-native application that resides on your Salesforce instance.
Describe the process deployed with regards to our data and the solution in the event that you, as a vendor, go out of business.	Youreka would present and discuss options to you to ensure your continued success on the Salesforce platform.
Has the service been the subject of external audit/assessment for: - ISO 27001/27002 certification? - SSAE16 (or earlier SAS70) - self certification CSA (Star)	This functionality is covered by Salesforce due to Youreka being a Salesforce-native application that resides on your Salesforce instance.
Please detail what information you hold about people (users, consumers etc.) and how much is required vs configurable etc.?	Youreka does not hold any of this information. The Youreka application could be used to collect such information but that is entirely dependent upon your configuration/use of the application.
Confirm that you will comply with all applicable data protection and privacy legislation/regulation for data at rest and in transit. Also please confirm that you maintain the appropriate organizational and technical measures to protect personal data.	Confirmed.
Provide information of the geographical location of all data storage included as part of the solution, i.e. production, DR, back-up etc.	All data that Youreka collects is stored within Salesforce, which means that geographically speaking, the data is stored in the Salesforce server that the Salesforce instance is housed in.
Confirm how you will notify us, according to the requirements of relevant privacy legislation, of any data breaches/incidents, suspected data breaches/incidents, near-misses or suspected near-misses.	This functionality is covered by Salesforce due to Youreka being a Salesforce-native application that resides on your Salesforce instance.
Will any sub-contractors be engaged in relation to the provision of the services? If so, please explain which elements will be sub- contracted and provide details of the sub-contractor(s).	No.
Will any other third parties have access to our Personal Data? If so, please provide details of the third parties and explain why access is required.	No.
Please confirm that all our data will be securely erased upon request or at termination of contract (within timescales specified by any applicable privacy legislation/regulation) using verifiable deletion methods?	Confirmed.
Detail how the solution handles user authentication, and confirm that it supports Single sign on (SAML 2.0 or OAUTH) using Azure AD as an IP.	Youreka’s mobile application for iOS and Android leverages the Salesforce Mobile SDK. The Salesforce Mobile SDK contains components to facilitate authentication (OAuth 2.0) and also secure encrypted local storage of data on a mobile device called SmartStore.
Please confirm that the application supports ADAL. If it does not, please detail how MFA is supported.	Confirmed.
Describe the authentication and authorization methods available (including roles-based access etc.).	https://developer.salesforce.com/docs/atlas.en- us.api_rest.meta/api_rest/intro_understanding_authentication.ht m
Confirm that the application supports least privilege - admin accounts have a limited privilege.	Confirmed.
What industry standards are followed for application or data integration (e.g. GS1 standard, AS2 Standard, EDIFACT etc.)?	https://resources.docs.salesforce.com/sfdc/pdf/integration_patter ns_and_practices.pdf
Does the application provide a mechanism to import and export data to and from external systems? Describe the data replication and synchronization capabilities available.	Yes. All Salesforce mechanisms are available for Youreka including middleware solutions.
Please provide details of integration middleware that is supported, and you have experience with.	Some of the middleware solutions our customers leverage today are Mulesoft, Boomi, Informatica, Jitterbit, etc.
Does the system have API/web services enabled integration that uses globally accepted open standards without requiring major coding or customization (SOAP/WSDL, REST, JSON, UDDI)? Please articulate any exceptions.	https://developer.salesforce.com/docs/api-explorer
Does the system use real time or batch orientated (e.g. ETL) messages? Is it possible to specify which approach is used for different messages and to optimize performance? Does the solution require any batch file transfers (e.g. FTP or SFTP/FTPS)?	Both real time and batch are options. Real time or batch is typically determined based on business requirements.
Does your solution include any integration with e-mail and/or SMS gateways and if so which features and integration are provided?	Youreka has functionality which can be disabled that allows end users to deliver a PDF version of the data they collected on their Form via email while on their mobile device. The PDF is attached to a draft email in the end users default mail application.
Which external reporting tools can your solution integrate with? Specifically, can it integrate with Microsoft BI tools (e.g. SSRS, Excel Services, PowerBI) and / or Tableau. Please state if there are any limitations on product versions that you can integrate with.	Yes, it can support Microsoft BI tools and Tableau.
Describe how automated and scheduled feeds to external services can be configured, and how access to this functionality can be controlled. Include details of how such feeds are appropriately protected for security and integrity.	This is at your discretion. You will need to integrate Salesforce with your external services, once connected, Youreka data will be available from the Salesforce side of the integration.
Describe the direct connection options that are available to the underlying data set.	https://developer.salesforce.com/docs/api-explorer
Describe what options are available to allow creation of additional custom reports by us, to meet requirements not fulfilled by the standard reports. Confirm that these custom reports are not impacted by future solution upgrades.	Youreka's data resides in your Salesforce instance which allows your end users to leverage Salesforce's standard reporting and dashboarding capabilities to design custom analytics for Youreka data. Confirming these are not impacted by future solution upgrades.
Describe how the solution can be configured to ensure that no report production is capable of creating a sustained lockout on any source or target systems for other service users.	This functionality is covered by Salesforce due to Youreka being a Salesforce-native application that resides on your Salesforce instance.
Confirm that all audit data and transaction history is available for reporting.	Confirming that this is configurable and abides by standard Salesforce capabilities/limitations.
What strategic alliances do you have with other software vendors or system integrators?	Youreka is an ISV and Consulting partner with Salesforce.
Do you offer implementation services or is this via a 3rd party? Where are these implementation resources located?	Youreka offers implementation services and our resources are located in the United States.
Please provide a brief description of the typical methodology (e.g. Waterfall, Agile DevOps) you use to deploy your solution.	Agile. We welcome the opportunity to engage with the business to learn more about your requirements.
Please describe how much of your solution is based on out of the box/simple configuration versus custom code?	95% out of the box/simple configuration. 5% custom code.
Do you have full support for training & educating the end users and system development/support staff? Is training offered on our site or remote locations? Do you provide a quick start or training guide? What languages do you support here? Do you provide ongoing training for new system users?	Youreka offers full support for training and educating the end users and system development/support staff. Training can be offered on site or via remote web sessions.
Highlight the role of the existing client community in influencing your future roadmap and product innovation	Youreka's roadmap is predominately driven by customer requests.

August 22, 2023 17:36
Updated

Comments

0 comments

Please sign in to leave a comment.