Trust & Security

Your organization trusts CTSO Central with member data, test scores, financial records, and more. We take that responsibility seriously. Security is embedded across every layer of the platform — from the infrastructure that hosts your data to the application features you interact with every day.

This page provides an overview of how we protect your information and keep CTSO Central reliable, private, and secure.

Our Approach

We follow a defense-in-depth strategy, which means we don't rely on any single security measure. Instead, multiple layers of protection work together so that if any one layer is bypassed, others remain in place. This approach spans our cloud infrastructure, network architecture, application code, and operational practices.

Infrastructure Security

CTSO Central is hosted on Amazon Web Services (AWS), one of the most widely trusted cloud platforms in the world. AWS data centers maintain rigorous physical security controls, environmental protections, and compliance certifications. By building on AWS, we inherit a foundation of security that meets the standards of governments, financial institutions, and healthcare organizations.

Network Protection

Your data travels through a secure, carefully structured network:

• Private network isolation: Our application services run inside a private network (VPC) that is not directly accessible from the public internet. Services are segmented across multiple isolated zones with strict access rules between them.
• Edge security: All traffic passes through Cloudflare's global network, which provides an additional layer of protection before requests ever reach our servers.
• Encrypted connections: All data transmitted between your browser and CTSO Central is encrypted using TLS (Transport Layer Security), the same standard used by banks and financial institutions. Internal communication between our services is also encrypted.

Threat Protection

We actively defend against common internet threats:

• Web Application Firewall (WAF): Every request to CTSO Central is inspected by a web application firewall that blocks known attack patterns, including those identified by the OWASP Top 10 — an industry-standard list of the most critical web security risks.
• DDoS mitigation: Automated protections guard against distributed denial-of-service attacks that attempt to overwhelm the platform with traffic.
• Bot detection: Managed rules identify and block automated abuse from bots and malicious scripts.
• Rate limiting: Requests are throttled at the infrastructure level to prevent abuse and ensure fair usage for all users.

Authentication & Account Security

We provide multiple layers of protection to ensure that only authorized users can access your account.

Sign-In Security

• Secure authentication: CTSO Central uses industry-standard protocols to verify your identity when you sign in, including integration with AWS Cognito for centralized identity management.
• Multi-factor authentication (MFA): You can add a second layer of protection to your account using authenticator apps (such as Google Authenticator or Authy) that generate one-time codes at sign-in.
• Passkey support: For an even more seamless and secure experience, CTSO Central supports passkeys — a modern, phishing-resistant sign-in method that uses your device's built-in security (such as fingerprint or face recognition) instead of a password.
• Account lockout: After multiple failed sign-in attempts, accounts are temporarily locked to prevent unauthorized access through password guessing.
• Password requirements: Passwords must meet minimum complexity standards, including length, mixed case, numbers, and special characters.

Session Management

• Short-lived sessions: Your sign-in session automatically expires after a period of inactivity, reducing the risk if you forget to sign out.
• Stolen session detection: If suspicious activity is detected with your session credentials, they are automatically revoked and you will be asked to sign in again.

Access Control

CTSO Central uses a role-based access control system to ensure that users can only see and do what they are authorized to.

Role Hierarchy

Access is organized into a clear hierarchy that mirrors your organization's structure:

• National Admin: Full access to manage all associations, chapters, and platform settings
• Association Admin: Manages chapters and members within a specific association
• Chapter Admin: Manages members and settings within a specific chapter
• Chapter Viewer: Read-only access to chapter information

Each role inherits the permissions of the roles below it, creating a natural chain of access that matches your organizational responsibilities.

Custom Roles & Permissions

In addition to the built-in roles, administrators can create custom roles and tailor permissions to match their organization's unique structure and workflows. This flexibility lets you grant exactly the level of access each user needs — no more, no less.

Scoped Permissions

Beyond roles, access is scoped to specific organizational boundaries. A Chapter Admin at one chapter cannot access data from another chapter. This ensures that your data stays within the appropriate organizational context, even when multiple organizations share the same platform.

Data Protection

Encryption

Your data is protected both when it is stored and when it is transmitted:

• Encryption in transit: All data moving between your browser, our servers, and our databases is encrypted using TLS 1.2 or higher.
• Encryption at rest: Data stored in our databases and file storage is encrypted using AES-256, the same encryption standard used by government agencies worldwide.
• Key management: Encryption keys are managed through a dedicated key management service with automatic rotation, ensuring that keys are regularly updated without any disruption.

Secure Data Storage

• Database security: Our databases are hosted in private network zones that are not accessible from the public internet. Access is restricted to authenticated application services only.
• Secrets management: Sensitive configuration values such as database credentials and encryption keys are stored in a dedicated secrets management service — never in application code or configuration files.

Secure Testing

For organizations that use CTSO Central's testing features, we provide additional security controls specifically designed to protect exam integrity:

• Graduated security levels: Tests can be configured with different security levels (0 through 4), allowing you to match the level of protection to the sensitivity of the exam.
• Secure browser: Higher security levels can require test-takers to use a locked-down browser that prevents access to other applications, websites, or system tools during the exam.
• Scoped access tokens: Test-takers receive access credentials that are purpose-limited — they can only be used for the specific test session they were issued for and cannot be reused to access other parts of the platform.

Monitoring & Incident Response

Continuous Monitoring

We monitor the platform around the clock to detect and respond to potential security issues:

• Application performance monitoring: Real-time monitoring tracks the health and performance of every service, alerting our team to anomalies before they become problems.
• Security event tracking: Failed sign-in attempts, unusual access patterns, and other security-relevant events are logged and monitored.
• Infrastructure alerts: Automated alarms watch for unusual resource usage patterns that could indicate a problem, such as unexpected spikes in traffic or server load.

Vulnerability Scanning

We regularly scan CTSO Central for security vulnerabilities to identify and address potential risks before they can be exploited:

• Dependency scanning: Our software dependencies are continuously monitored for known security vulnerabilities. When a vulnerability is discovered in a library we use, we are alerted and can update to a patched version quickly.
• Static analysis: Our codebase is analyzed for common security weaknesses — such as injection flaws, insecure data handling, and misconfigurations — as part of our development process.
• Infrastructure scanning: Our cloud environment is periodically assessed to ensure that configurations follow security best practices and that no unintended access points have been introduced.

Audit Logging

Actions taken within CTSO Central are logged to support accountability and troubleshooting. These logs help us investigate incidents, verify compliance, and maintain a clear record of platform activity.

Availability & Reliability

We design for reliability so that CTSO Central is available when you need it, especially during critical periods like conferences and testing windows.

• Multi-zone deployment: Our infrastructure is distributed across multiple availability zones within a geographic region, so the platform remains available even if one zone experiences an outage.
• Auto-scaling: The platform automatically adjusts its capacity in response to demand, ensuring consistent performance during peak usage periods such as conference registration or large testing sessions.
• Centralized logging: Logs are replicated to a separate, secure location so they are preserved even in the event of an infrastructure issue.

Data Privacy

Protecting the privacy of your members — especially students — is central to how we build and operate CTSO Central. We design the platform to collect only what is needed, keep data under your organization's control, and handle it responsibly at every stage.

Data Minimization

CTSO Central collects only the information necessary to support the features your organization uses. We do not collect or store data beyond what is required for platform functionality.

Your Data, Your Control

• User deletion: Administrators can permanently delete user accounts. When a user is removed, their associated data — including evaluations, scores, and registrations — is also removed to ensure nothing is left behind.
• Connected app consent: When third-party applications request access to your data through CTSO Central, you are shown exactly what permissions are being requested and must explicitly approve them. You can revoke access to any connected application at any time from your account settings.
• Export controls: Access to member data exports is governed by permissions, ensuring that only authorized users can extract data from the platform.

Data Retention

We retain data only as long as it is needed:

• Temporary credentials such as password reset links expire automatically after a short window and are cleaned up by the system.
• Session data expires after a period of inactivity, ensuring that stale sessions do not persist.
• Audit records are retained to support accountability and compliance but do not include sensitive information such as passwords.

Third-Party Data Sharing

CTSO Central does not sell your data. When third-party services are involved — such as payment processors or communication tools — data sharing is limited to what is necessary for that service to function. All third-party integrations are subject to strict access controls, and connections are validated to prevent unauthorized data exposure.

Privacy Policy

For a complete description of how we collect, use, store, and protect your information, please review our comprehensive Privacy Policy on the CTSO Central website. The privacy policy covers topics including the types of information we collect, how we use and share that information, your rights regarding your data, and how to contact us with privacy-related questions.

Shared Responsibility

While we invest heavily in securing the platform, some aspects of security are a shared effort between CTSO Central and your organization. Here are steps you can take to help protect your data:

• Enable MFA on all administrator accounts
• Use strong, unique passwords that you don't reuse across other services
• Review user access periodically to ensure that only current staff and advisors have accounts
• Sign out when using shared or public computers
• Report suspicious activity to your organization's administrator or to our support team immediately