Cloud Platform 

To ensure the highest levels of information systems and data protection, management, and compliance, the ExtremeCloud platform conforms to ISO / IEC 27017 and is certified by DQS to ISO / IEC 27001 and ISO / IEC 27701, the International Standards Organization (ISO). It also conforms to CSA-STAR security and compliance certification. FedRAMP certification is expected to be completed by the end of 2023.

Threats to the availability, integrity, and confidentiality of customer's information are taken seriously. Extreme is the first major cloud networking vendor recognized by the global standard for commitment to information security management systems best practices and controls.

Extreme secures access to the underlying computing infrastructure with features like VPC, NAT, TLS encryption, reporting tools and automated password protection. Along with limiting access, Extreme also monitors and tracks DevOps-personnel activities in its cloud environments, with a server and application audit trail.

Extreme Networks’ Cloud Services are hosted within Amazon Web Services (AWS), Microsoft Azure, and Google Cloud data centers, taking advantage of their security and compliance capabilities at the data-center layer. Extreme Networks takes additional measures to secure our cloud-based applications.

Extreme employs Industry-standard OS hardening processes for production server deployment. All ExtremeCloud IQ releases and patches are hardened with continuous penetration scanning for application vulnerabilities, to prevent any issues prior to actual deployment in production.

Extreme provides daily backups of production-network data, and storage of backups in an encrypted state. For added security, our cloud networking solution also encrypts data while in transit between a customer’s site and the Regional Data Center (RDC) containing the customer’s ExtremeCloud IQ instance. The RDCs do not collect or retain any data traffic generated on the customer networks.

ExtremeCloud enables our customers to address data privacy and GDPR-related obligations for the “rights to request and be forgotten”, by enabling administrators to search, download, and delete personal data within their network management platform.