|Trust Center

ScreenSteps, Inc.

ScreenSteps provides a cloud-based Knowledge Operations platform that includes tools for knowledge capture, knowledge base, and custom-built courses.

fa-envelope alpaca-fa-regular
security@screensteps.com
fa-link alpaca-fa-regular
Privacy Policy

FAQ

fa-magnifying-glass alpaca-fa-regular
chevron-down
ScreenSteps Overview

ScreenSteps is a SaaS application that runs in the cloud. While it does have a desktop application that allows users to edit article content, all data is stored and delivered from servers managed by ScreenSteps. This document provides a brief overview of steps taken by ScreenSteps to ensure that the application is secure and that customer data is handled according to accepted security standards.

  • Once a year ScreenSteps has a penetration test performed against the web application by security and vulnerability professionals in order to locate any security deficiencies. We contract with Netragard to perform this service. They have certified us against the OWASP top 10 list of security vulnerabilities.
  • ScreenSteps employs a SOC-2 certified company to manage development operations. This team helps us keep our application, database, and utility working around the clock and up to date with security patches.
  • ScreenSteps runs on Amazon AWS. The application is delivered from servers in the us-east region. A disaster recovery environment is maintained in the us-west region. The databases in the recovery environment mirror the databases in the production environment so that a switch can be made quickly in case something happens to us-east.
  • ScreenSteps uses Cloudflare which contributes to our high availability infrastructure by providing firewall, DDoS attack protection, DNS, and CDN services. 
  • ScreenSteps uses an advanced in-app security service which provides a RASP (Runtime Application Self-Protection) and In-App WAF (Web Application Firewall). This helps protect against  Account Takeovers, protects against the OWASP top 10, SQL injections, and more.
  • The application environment is routinely monitored for out-of-date libraries with known vulnerabilities so that they can be updated.
  • Access to the production server is limited based on role. Those with access can deploy updates, run the disaster recovery play book, or troubleshoot issues with customer data when required. The engineers are located in different parts of the U.S. (east coast and midwest).
  • Code is managed using Git. All Pull Requests (code changes) go through a peer review process and automated tests run by a Continuous Integration (CI) service. Any change can quickly be rolled back if an unforeseen issue arises after the code is deployed.
  • Data stored in the ScreenSteps application is encrypted at rest. Database backup files are encrypted as well. We periodically restore the database using a backup file to ensure that the backups are viable.
  • We perform reviews on our policies and procedures that affect application security and availability.
chevron-down
Do ScreenSteps employees have access to customer data?
  • Employee access to customer information is controlled based on role.
  • We use staging and development environments so that developers who do not need production access do not have access to customer data.
  • Support personnel have limited access to customer data as needed to offer support.
  • Employees with access to sensitive customer data use computers with encrypted hard drives. 
  • Employee computers are monitored to ensure they are configured securely.
  • Employees are required to go through security training.
chevron-down
IT Summary for the ScreenSteps desktop application and Browser Extension

ScreenSteps Desktop IT Summary

The ScreenSteps desktop application is an editor for articles in the ScreenSteps web application. This document describes issues that are of interest to an IT department that manages the installation of desktop software on employee computers. While the desktop application is available for both Windows and macOS, this document will focus on Windows.

  • The ScreenSteps desktop application has been signed with our developer certificates for Windows and macOS. The application has been notarized on macOS.
  • The ScreenSteps desktop installer for Windows can be installed for all users on a computer or for the current user if no Admin rights are available. There is also an MSI installer package available. 
  • The desktop software includes an automatic update feature using the WinSparkle framework on Windows. Updating the application requires the same permissions as the original installer. While auto update checks can be turned off in preferences, the IT department can specifically turn off updates by setting the HKEY_LOCAL_MACHINE\Software\ScreenSteps\4\Settings\CheckForUpdates to never. The MSI installer automatically sets the registry entry to never so that all updates are controlled by the IT department.
  • The desktop software requests data from a couple of different domains that may need to be whitelisted in your environment. You can find the list of domains in the following help article: https://help.screensteps.com/m/9096/l/692851-screensteps-desktop-whitelist-domains
  • The desktop software includes a screen capture feature. If the security software running on your computers requires applications to be whitelisted in order to capture the screen then ScreenSteps will need to be added to the whitelist.

ScreenSteps Browser Extension IT Summary

The ScreenSteps  Browser extension allows you to provide your employees with the information and guidance they need in any web application they access through the Google Chrome or Microsoft Edge (version 77 or later) browsers. This document describes issues that are of interest to an IT department that manages the installation of desktop software on employee computers.

As a SOC 2 certified Service Organization we follow industry best practices in all phases of the Software Development Life Cycle (SDLC).

Chrome Web Store

  • Once our browser extension is submitted to Google for inclusion in the Chrome Web Store it undergoes an audit of the source code as well as a security review.
  • Once published to the Chrome Web Store it is packaged into a CRX3 file format which is signed with multiple public_key+signature tuples which Chrome uses to verify that the extension being installed is from the Chrome Web Store and contains unmodified content from what we provided to the Chrome Web Store to be published.

Microsoft Edge Add-ons

  • Once our browser extension is submitted to Microsoft for inclusion in Edge Add-ons it undergoes an audit of the source code as well as a security review.
  • Once published to Edge Add-ons it is packaged into a signed CRX3 file format which Edge uses to verify that the extension being installed is from Edge Add-on and contains unmodified content from what we provided to Edge Add-ons to be published.
chevron-down
What is ScreenSteps Privacy Policy?

Our privacy policy can be found at the following url:

https://www.screensteps.com/privacy-policy

chevron-down
What is ScreenSteps' privacy policy when it comes to our AI tools?

We are using OpenAI's apis with a setting that instructs them not to use content to train or improve their models.

You can see more information here: https://platform.openai.com/docs/models/how-we-use-your-data

When ScreenSteps uses AI one customer accounts data is not mixed with another customer accounts data. This ensures data separation when using AI.

Data sent to the OpenAI APIs may be retained for up to 30 days in order to help identify abuse, after which it is deleted.