What are OutreachSystems' security practices, and is my Neoserra database secure?
Yes! OutreachSystems provides state-of-the-art Client Activity Tracking Systems that are designed to never compromise your clients' data. We know that security is crucial to you and your clients, which is why we also make security our top priority.
Neoserra is hosted in Amazon Web Services (AWS) and uses a layered, defense-in-depth security architecture to protect client data. Our environment incorporates services including AWS Web Application Firewall (WAF), Elastic Load Balancing, AWS Security Groups, Amazon GuardDuty, AWS Security Hub, and Amazon CloudWatch, together with encrypted HTTPS/TLS communications, restricted network access, and controlled administrative access. Database and internal systems are not directly exposed to end users, and access between system components is limited to what is operationally required.
We continuously monitor and maintain the environment through security logging, threat detection, vulnerability review, patching, and configuration management. These controls are designed to reduce exposure to both conventional and AI-assisted attacks by limiting attack surfaces, filtering malicious traffic, detecting suspicious activity, enforcing least-privilege access, and keeping infrastructure and software current as threats evolve.
Privacy
We understand that you care about how information about you and your organization is collected, used, and shared. OutreachSystems is committed to protecting your privacy and safeguarding the information entrusted to us. Our Privacy Policy describes how we collect, use, and disclose information obtained from you and your organization through our websites.
Confidentiality
OutreachSystems employs reasonable administrative, technical, and physical security measures designed to protect your data against unauthorized access. Our staff may access your database only when necessary to assist with customer service or support requests. Our Terms and Conditions expressly prohibit the use or disclosure of customer data for any other purpose:
- OutreachSystems will not sell, lend, rent, encumber, pledge, lease, or transfer Customer's Property. Except as authorized by the Customer, OutreachSystems will not disclose to any other party, or use for its own benefit, any data contained in Customer database.
Physical Security
Your Neoserra database is hosted across two separate secure co-location facilities, providing geographic redundancy and supporting clients across different U.S. time zones. One facility is located on the East Coast and serves clients in the Central and Eastern time zones, while the other is located on the West Coast and serves clients in the Western and Mountain time zones. The co-location facilities are managed by Amazon and provide 24-hour physical security, redundant electrical generators, redundant data center cooling systems, and other backup infrastructure designed to support continuous server availability. Access to the Neoserra servers and the databases they host is restricted to authorized personnel.
Backup and Recovery
The Neoserra databases are hosted in two separate Amazon Web Service (AWS) regions: AWS Oregon and AWS N. Virginia.
Each night, every Neoserra database is backed up to another server in the same AWS region as the SQL Server. These backups are compressed and then uploaded to the Amazon S3 service in a different region. OutreachSystems maintains backups going back 30 days. Non-relational data is also synchronized to the alternate region in a hot-standby location. The master service directory database is replicated real time in three data center locations (the regions and corporate).
In the event of the catastrophic loss of a region, the most recent backup will be extracted from the Amazon S3 service in the backup region. The backup will be restored and the Neoserra master directory will be updated to reflect the new region of service.
As indicated in the following table, work priorities are organized from critical to routine and allocated response and completion time:
| Rating | Response | Completion | Definition |
| Critical | 2 hours | 24 hours | Immediate risk to data integrity and business continuity |
| Urgent | 8 hours | 48 hours | Prevention of critical time-sensitive function |
| Important | 24 hours | 7 days | Possible risk to operation |
| Routine | 48 hours | 28 days | No immediate impact on operations |
| Planned | 14 days | As planned | Subject to planning |
SQL Server Security
Neoserra is built on Microsoft SQL Server, a robust and scalable database platform capable of supporting thousands of records and multiple concurrent users.
Because Neoserra operates across multiple SQL Server environments, there is not a single SQL Server version in use across all systems. All SQL Server instances currently in use are version 2014 or later.
All database transactions are processed through T-SQL stored procedures, providing an additional layer of security while supporting efficient and consistent database operations. Direct access to the SQL Servers is restricted to authorized OutreachSystems staff. Access credentials are managed securely, and passwords used by OutreachSystems personnel are changed regularly.
Encryption
Your data is always encrypted in both transit and at rest using the highest recommended standards. Currently, TLS 1.3 PQC is used for transit and AES-256-XTS for data at rest.
Post-Quantum Computing (PQC)
OutreachSystems has begun transitioning cryptographic standards in anticipation of post-quantum computing. Our TLS security policy has already been elevated to TLS 1.3 PQC. Transition of stored credentials is expected to be completed before 12/31/2026.
Firewalls
The Neoserra servers include "firewalls" that we monitor and that are designed to protect against unauthorized access to our systems.
Due to recent international threats, OutreachSystems blocks all countries outside of our immediate customer service area (Americas and the Pacific) and we may even block countries in the Americas based upon specific threats viewed in the logs.
International Access
OutreachSystems blocks all access from any IP located in these countries:
Access ID and Password
Neoserra is accessible on the Web using Internet Explorer, Mozilla Firefox, Google Chrome and Apple Safari. Neoserra is designed to limit online access to those users possessing the username and password associated with their account(s). Neoserra employs 2-Factor Authentication which means that in addition to a password the user will need to authenticate themselves via a second medium.
One administrator account will be provided when your database is initially configured. The administrator, assigned by the lead center, will be responsible for providing usernames and passwords to all users. Users should never share their login account information and their passwords should conform to the following requirements:
- Whenever possible, you should use at least 14 characters or more (a minimum of 10 is required).
- Passwords must include mixed-case characters, digits and specialty characters.
- Passwords should use the entire keyboard, not just the letters and characters you use or see most often.
If a Neoserra user is no longer active with your program, it is imperative that you inactivate their login account! If you forget to inactivate a user, or a user stops using Neoserra, then their account may be automatically locked for security reasons, as discussed in this FAQ. As noted in the FAQ, you can see if any active user accounts have been automatically locked in the security panel on the home page of Neoserra.
How to Protect Yourself Online
Beyond the security measures offered by OutreachSystems, each user should also exercise certain precautions to protect themselves and the Neoserra data from unauthorized access.
User ID and Password
Users should follow these rules to protect themselves and the data in the Neoserra database:
- Never disclose your username or password to anyone else.
- Memorize your username and password, and make sure not to write them down.
- Don't use birth dates, names, or other easily guessed combinations of letters or numbers
- Don't be taken in. OutreachSystems will never send you an e-mail asking for your username or password.
In addition to the recommendations listed above, administrators should also be aware of all employees who are no longer with your organization. Usernames and passwords associated with employees who have left your organization should be immediately revoked. Users who believe that their passwords have been compromised should immediately notify their administrator and change their password.
Log Out
When you are done online, log off. We suggest you do this before you shut your computer off. By default, Neoserra will automatically log you off after 12 hours of idle time.
Individual Computer Security
All users should protect their own computer by doing these things:
- Keep your operating system and browser up to date.
- Install a personal firewall.
- Install anti-virus software and keep it up to date.
- Scan your computer for spyware on a regular basis.
- Never download programs or files from unknown sources.
Want more? Browse our extensive list of Neoserra FAQs.