---
updatedAt: 2025-11-07T20:04:17.000Z
agentTools:
  projectIndex: https://docs.getmontecarlo.com/llms.txt
---

# Application Security

# Overview

Monte Carlo embeds security into every phase of software development. From system design through production deployment, our engineering teams follow a secure development lifecycle that integrates automated testing, peer review, and continuous validation to ensure application reliability and data protection.

***

## Secure Development Lifecycle

Security is built directly into Monte Carlo’s engineering workflows. Code undergoes static and dynamic analysis in our CI/CD pipelines, and dependencies are automatically scanned for known vulnerabilities. Every change is peer-reviewed and approved.

Before deployment, changes are tested against recognized risks such as the **OWASP Top 10** and **CWE** categories.

Development, staging, and production environments remain isolated, and all releases follow formal change-management approvals to maintain code integrity.

***

## Access and Authentication

At the application layer, Monte Carlo enforces granular access controls through **Role-Based Access Control (RBAC)**, **Single Sign-On (SSO)**, and **Multi-Factor Authentication (MFA)**. Session management policies limit token lifetimes and detect anomalies in account activity.

These measures govern user and customer access, complementing the infrastructure-level IAM protections described in the previous section.

***

## Data Protection and Encryption

All data handled by the Monte Carlo Platform is encrypted in transit and at rest using **TLS 1.2+** and **AES-256** encryption.

Data segregation ensures that each customer’s environment remains logically isolated.

Data retention and deletion policies follow least-privilege and data-minimization principles consistent with global privacy regulations.

***

## Vulnerability Testing and Remediation

Monte Carlo conducts ongoing application-level vulnerability assessments. Automated scans and third-party penetration tests evaluate API and interface security, while our responsible disclosure program encourages external researcher input.

All findings are triaged by severity, tracked through formal SLAs, and re-tested following remediation to verify closure.

***

## Change Management and Deployment Security

Application deployments are automated and auditable. Monte Carlo uses **Infrastructure-as-Code** to define approved configurations and **immutable build artifacts** to ensure that only signed, verified code reaches production.

Automated rollback and separation of duties between engineering and operations teams reduce deployment risk and prevent unauthorized changes.

***

## Monitoring and Application Defense

Application behavior is continuously monitored through centralized logging and anomaly detection systems.

Suspicious API activity, authentication anomalies, and injection attempts trigger real-time alerts routed to Monte Carlo’s on-call security engineers.

Application-level telemetry integrates with our broader infrastructure defense systems for unified detection and response.