Security at the core

We realize that security incidents in our industry create uncertainty and that our customers and partners might have a lot of questions about security in general and our approach to security in particular. We will be as open and transparent about our process as possible. 

We developed the Ava video security solution to include security in all aspects of design and implementation:

• We don’t have super administrator accounts that have access to all customer systems.
• There are no hidden or backdoor accounts on either Ava Aware or Ava Aware Cloud.
• Remote access is opt-in and limited in the scope of access by the customer.
• Ava’s use of the Deployment Management Portal (DMP) is controlled via MFA and is logged.
• At Ava, there aren’t any separate support team-managed servers used for updates or customer deployment tuning. All updates are managed and controlled by the core platform, which has all the security controls. 
• All employees receive security training and detailed training on the handling and management of any customer data.
• We have strong internal security controls and processes compliant with ISO 27001. Admins have role-based access, mandatory multi-factor authentication with physical tokens, and strong passwords. We also use a dedicated Red Team doing security testing, a Product Security Incident Response Team (PSIRT), and structured processes for handling security incidents.
• All Ava Security staff are required to run the Ava Reveal Agent for data protection. This allows us to detect internal risks within Ava, ensure customer data is protected, and ensure our role-based access control policies are followed. 
• We also require all staff to install industry-leading anti-malware defense controls and control software to restrict the accessing of files and information. 
• We use a centralized asset inventory tool to track and manage all assets and ensure all machines are kept up to date with the latest security patches.
• We use a Secure Development Environment with restricted access based on role. Source code changes are reviewed and audited. Deployments of source code are also monitored.
• We employ a defined approach to classifying sensitive and non-sensitive information and policies defining means to handle access, internal, external, and electronic distribution, storage, and disposal/destruction.
• All data is encrypted in transit and at rest. We use encrypted communication channels, such as HTTPS and TLS, for all communications between Ava Cameras, Ava Aware, and any viewer or administrator. These channels are all secured using certificates and private keys.
• Exported video is encrypted with AES-256. Exported video and the accompanying metadata files are also digitally signed to verify that the video recordings and metadata have not been tampered with since being exported. Each video recording and metadata file in the exported archive has a hash created using the SHA-256 cryptographic hashing tool.
• The Ava Camera hardware is based around an Ambarella processor. This processor has market-leading security and meets all of our security requirements. The Ambarella processor supports the Arm TrustZone technology to separate the secure cryptographic operations from the main application. Ava Cameras are also equipped with a Trusted Platform Module (TPM) to provide secure encryption key storage for each camera.
• Our hardware has hand-picked components, and we have tight control over the manufacturing process.
• As part of the manufacturing process, each device is pre-loaded with a digital certificate to prove its identity to other devices and the Ava Aware Cloud.
• We operate on the principle of least privilege, and only a small number of staff responsible for cloud operations have platform layer access to our cloud infrastructure. This access itself is audited and requires multi-factor authentication, including strong passwords, physical tokens, and VPN access.

If you have any questions regarding our approach to privacy and security, please email us at sales@avasecurity.com at any time.