---
title: "Application Security Practices"
canonical: "https://servicedesk.maxgeo.com/space/MAXGEO/1724285107/Application%20Security%20Practices"
format: markdown
---
This document provides a comprehensive overview of security controls, practices, and responsibilities related to Maxwell GeoServices (maxgeo) DataShed5 application. It is designed to assist clients in understanding the security posture of the application and their associated responsibilities.
> Macro (toc)
## 1. General Information and Vendor Security Practices
| | |
| --- | --- |
| **Question** | **Answer** |
| Provide a detailed description of the application, including its primary functions, architecture, and key dependencies | The maxgeo application is a web-based platform built on Microsoft ASP.NET, incorporating JavaScript libraries and frameworks including Bootstrap and DevExpress. Its core functions include database management, importing/exporting, data editing, and reporting. Architecture is documented in the supplied architecture diagram; dependencies are detailed in the pre-install checklist. |
| What operating systems and versions are supported? | The application is supported on Windows Server environments. |
| Does the vendor follow secure development practices, including threat modeling and secure coding standards? | Yes. maxgeo adheres to OWASP Top 10 secure coding principles and conducts internal threat modeling during feature design. Role-based access controls are implemented using mixed-mode SQL authentication. Environments must meet secure deployment requirements such as valid SSL certificates and hardened IIS settings. |
| How frequently are the application’s security policies reviewed? | Annually, or after any major architectural changes, regulatory shifts, or security incidents. |
| Is documentation available for installation, configuration, and security best practices? | Yes, available upon request. For client self-installation a disclaimer must be signed. |
| What are the available support channels and SLAs for security-related issues? | Support is available via our online Knowledge Base and ticketing portal. In urgent situations, where support is required in under 8 hours, a phone call can be made to the maxgeo regional office. |
| Penetration testing | maxgeo perform regular internal and external network pentation testing. All penetration test are CREST Certified |
## 2. Compliance and Regulatory Considerations
| **Question** | **Answer** |
| --- | --- |
| Is the application compliant with standards such as ISO 27001, NIST, or SOC 2? | Not certified at present; internal practices align with core principles of these standards. |
| Does the application assist in meeting GDPR, HIPAA, or PCI DSS requirements? | The application supports compliance efforts, but ultimate responsibility for regulatory compliance lies with the client. |
| Has the application been independently audited for security? | An independent security audit is scheduled for this year. |
| What is the licensing model, and are there restrictions? | Administration licenses are user-assigned; general licenses operate on a concurrent user basis. |
| Are third-party or open-source dependencies used? | Yes. Key components include the PROJ library (MIT licensed) for spatial data, vetted and monitored for security by maxgeo. |
## 3. Installation and Deployment Security
| **Question** | **Answer** |
| --- | --- |
| What security measures are in place during installation? | Installation packages are delivered via secure sources. |
| Are system permissions or admin rights needed? | Yes. Local administrator access and SQL Server sysadmin rights are required. |
| Are secure configuration guidelines provided post-installation? | Yes, available in the user guide. |
| Are there default settings that should be modified? | MFA prompt frequency should be reviewed and adjusted. |
| Does the application support sandboxing or isolation? | Not currently supported. |
| Are there recommendations for limiting access to sensitive system areas? | Yes. Access is restricted to required databases only. |
## 4. Data Security and Privacy
| **Question** | **Answer** |
| --- | --- |
| What type of data is processed or stored? | The application processes geological and mining data. |
| Where is data stored and how is it protected? | Data is stored in SQL Server databases using dedicated SQL-authenticated users. |
| Is data encrypted at rest and in transit? | Encryption in transit is supported when a valid SSL certificate is applied. |
| How are encryption keys handled? | SSL certificates are managed and stored on the server. |
| Does the application support data retention or secure disposal policies? | Data lifecycle policies are client-managed. |
| Are residual data and temporary files securely managed? | IIS application recycling helps mitigate residual data exposure. |
## 5. Authentication and Access Control
| **Question** | **Answer** |
| --- | --- |
| Does the application support local accounts or directory integration? | Yes, through a built-in admin and user management interface. |
| Is multi-factor authentication supported? | Yes, via email verification. |
| Is role-based or attribute-based access control implemented? | Yes. Access can be configured per user role, admin panel, or database section. |
| Are permissions customizable to protect sensitive data? | Yes. Fine-grained access control is available. |
| How are sessions managed? | Default session timeout is 20 minutes (configurable). |
| Are session tokens or cookies securely stored? | Yes. Tokens are sent over HTTPS, scoped with SameSite policies, and stored securely to prevent XSS or CSRF attacks. |
## 6. Application and System Security
| **Question** | **Answer** |
| --- | --- |
| What measures protect the application from tampering or reverse engineering? | Enforced HTTPS, no client-side storage of sensitive data, immutable builds, secret management, and signed deployment packages. |
| Are techniques like code obfuscation or secure compilation used? | Yes. Debug symbols are excluded, assemblies are signed, and static analyzers (e.g., SonarQube) are used. |
| What system resources are required? | Standard ports (80/443) and SQL Server port 1433. Latest i7 or equivalate, 16GM RAM for SQL Server or Web Server, 32GB RAM if on the same server. 100GB HDD/SSD space |
| Are elevated privileges required? | No additional privileges are needed post-installation. |
| Are system-level dependencies a security concern? | Dependencies include IIS and SSL certificates, which are managed securely. |
| How does the app respond to OS or dependency updates? | No known compatibility issues. |
## 7. Updates, Patching, and Vulnerability Management
| **Question** | **Answer** |
| --- | --- |
| How are updates delivered? | Manually applied by maxgeo staff. |
| Are updates digitally signed? | Not currently implemented. |
| How often are patches provided? | Quarterly, with urgent patches issued as needed. |
| Is rollback supported? | Yes. Backups of the database and application are made prior to updates. |
| Is there a responsible disclosure policy? | No formal policy, but we maintain a structured patch process. |
| How are customers notified of vulnerabilities or patches? | Notifications are sent directly to clients via email or official channels. |
## 8. Logging, Monitoring, and Incident Response
| **Question** | **Answer** |
| --- | --- |
| What events are logged? | User activity, system events, and security incidents are logged. |
| Are logs customer-accessible or SIEM-integrated? | Logs can be accessed locally or via SEQ integration. |
| Does the application monitor for security events? | Basic event logging is built-in. |
| Can real-time alerts be configured? | Not directly through the application. |
| Is incident response guidance provided? | Formal documentation is not yet available; support is provided during incidents. |
| Are forensic or recovery tools available? | While no tools are embedded, logs and backups are available to assist with investigations and recovery. |
## 9. Network and Communication Security
| **Question** | **Answer** |
| --- | --- |
| Does the application require network access? | Yes, for SQL Server access and licensing validation. |
| What are the recommended firewall/proxy settings? | Allow TCP ports 80, 443, and 1433 (if default SQL port is used). |
| Are communications encrypted? | Yes. All external traffic, including licensing, uses HTTPS. |
| Can customers monitor or restrict traffic? | This is managed at the customer’s firewall/proxy layer. |
| Can the application run offline? | Internet access is required for license validation. |
## 10. Vendor and Third-Party Risks
| **Question** | **Answer** |
| --- | --- |
| Are third-party libraries or APIs used? | Yes. These include DevExpress, PROJ (MIT), and Mapbox. |
| How are third-party risks evaluated? | Libraries are reviewed regularly, tested in dev environments, and updated quarterly or as needed. |
| What is the vendor's security track record? | maxgeo has supported enterprise clients for over a decade with a strong focus on security and reliability. |
| Are security assurances or warranties provided? | While formal warranties are not issued, maxgeo applies layered security measures to protect client data. |
## 11. Customer Responsibilities and Recommendations
| **Question** | **Answer** |
| --- | --- |
| What are customer responsibilities regarding application security? | Clients must secure their infrastructure, apply OS and antivirus updates, enforce appropriate access controls, and ensure proper user training and data backups. |
| Are specific hardening or configuration steps required? | Yes. Clients should review the pre-install checklist, enforce SSL usage, and configure access controls aligned with internal policies. |
## 12. Application and Cloud Architecture
DataShed5 Application Diagram
LogChief Lite Application Diagram
LeaseControl Application Diagram
maxgeo Cloud Environment Diagram
Cloud Advanced Diagram
This document is true as of 6/9/2025