ETO FAQ's

Orange

Pink

Green

Blue

Social Solutions takes all necessary precautions to ensure that data is kept safe, confidential and recoverable in the case of a disaster. Our Efforts to Outcomes (ETO™) software meets current HUD Domestic Violence, HMIS, Social Security Administration (SSA), and HIPAA data management and security protocol.

  • HIPAA FAQs
  • How are user accounts managed?
  • What guidelines control ETO’s password functionality?
  • How does program security affect users and their access to data?
  • Is ETO software encrypted?
  • How are Encrypted Data Discs secured?
  • How do I know that it’s safe for Social Solutions employees to access our data?
  • Where is data stored?  What security elements are present at the storage facility?
  • How are servers secured?
  • What about visitor access?
  • Do the servers have anti-virus protection?
  • What is the plan if there is a disaster of some sort?
  • Best Practices/Certification
  • Redundant Infrastructure
  • Backups
  • Schedule
  • Retention Policy
  • Disaster Recovery Testing
  • Scope of the Policy
  • Services included in maintenance
  • Services outside the scope of maintenance

Data Security

The ETO web-application utilizes user name and password functionality to prevent unauthorized application access and roles to restrict user access to components within the application.  Each unique logon is assigned one of nine customizable levels of access, and these levels can be customized to allow certain users access to programs and features that other users should not necessarily have access to. Role levels typically range from the System Administrator, who manages all the structural elements of the data (often as many as 100 features), to Program Managers who have access to individual and aggregate staff and client information (typically 20-30 features), to end-users who have the narrowest needs (typically 10-15 features).

  1. Enterprise Manager – Manages sites across the web address/URL.
  2. Site Manager – Can make changes to the site with wizards and management features.
  3. Department Head – Can run queries on site-wide data.
  4. Program Manager – Can supervise staff work through ETO using the multiple management features below Administration on the Navigation Bar.
  5. Staff – Enter data on demographics, attributes, processes, assessments, Point of Service elements, etc.
  6. Funder/Reports Only – Can run reports only, no data entry.
  7. Intake – View demographics and enter reliable contacts only.
  8. Survey Taker – Take a survey and/or self-assessment.
  9. Entity Self Service – Entity self-assessment and update own attributes.

Requests for changes to access levels and password resets are funneled back to the client’s local site administrator. Social Solution Customer Support will provide support to the local administrator as needed to understand the implications of these changes.

Social Solutions recognizes the importance of maintaining secure and confidential access to client data. To that end, ETO software offers a password protection and management tool.

  • All users must have a unique identifier (i.e., username)
  • Passwords can be set to have a minimum length and contain a minimum number of numeric and non alpha-numeric elements
  • Passwords can be reset (this is manageable at the site or system level)
  • Access to password files is restricted
  • Passwords are not displayed upon entry

Data housed in ETO is stored and processed separately according to programs. For example, users who are working on the ABC project access and process ETO data separately from users working on the XYZ project. Users assigned to the ABC program or the XYZ program can only see data for the participants, services, or outcomes associated with that program. More specifically, ETO users on the ABC program cannot access or view data belonging to an ETO user for the XYZ program. Users without access to any program cannot see any data. This protection extends down to the program level.  One user in one program cannot see data in any another program from within that program. Confidential data stored in ETO is protected by file or volume encryption.

The application is accessed by users via a secure HTTPS connection to the ETO software web application server. The HTTPS protocol which is designed to prevent eavesdropping and tampering, provides a secure communication channel to ETO application.

Data files stored on Elastic Compute Cloud (EC2) instances reside on a Microsoft New Technology File System (NTFS) volume, which uses Microsoft’s Elastic File System (EFS) encryption. EFS uses a FIPS-validated 256-bit AES encryption method on all the databases on the volume as it is stored. The encryption persists for the life of the volume. EFS makes the data accessible only to users with authorized access, and makes it inaccessible to software that circumvents normal access control, such as if the media were stolen. All these uses of encryption employ government-approved algorithms and implementations that are FIPS 140-2 compliant.

All prospective employees of Social Solutions undergo a basic background check prior to their hiring. This screening process includes fingerprinting, confirmation of prior employment, and address checks. Each employee signs confidentiality/non-disclosure agreements as a condition of their hire. 

Physical Security

All ETO data entered or modified by ETO users is stored on dedicated servers, isolated via a Virtual Private Cloud (VPC), in a MySQL database located within Amazon Web Services (AWS).   ETO is accessed by users via a secure HTTPS connection to the ETO web application servers.

Social Solutions uses a third party 24/7 security service company that monitors Social Solutions’ infrastructure for any anomaly in our network including intrusion, detection and prevention.  ETO goes through regularly scheduled, once a quarter, penetration testing and weekly vulnerability testing.

AWS data centers are housed in nondescript facilities. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, intrusion detection systems, and other electronic means.  Authorized staff must pass two-factor authentication a minimum of two times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff.

AWS only provides data center access and information to employees and contractors who have a legitimate business need for such privileges. When an employee no longer has a business need for these privileges, his or her access is immediately revoked, even if they continue to be an employee of Amazon or Amazon Web Services. All physical access to data centers by AWS employees is logged and audited routinely.

All of our servers have Microsoft’s Forefront Anti-Virus software installed with the following features set forth:

  • Anti-virus: inbound / outbound network monitoring against known virus and worm signatures, as well as deletion of detected and/or blocked virus and worms.
  • Network monitoring of HTTP, HTTPS, SMTP, and FTP traffic for known signatures corresponding to abnormal behavior and attacks against end users.
  • Spam filtering: inbound / outbound network monitoring and detection of unsolicited or spoofed SMTP and POP mail.

Disaster & Data Recovery

Social Solutions Global, Inc. uses Amazon Web Services (AWS) hosting facilities for data protection, disaster recovery, and backup strategy.   As part of this partnership, Social Solution’s clients receive the benefit of a world class managed and fully redundant data center infrastructure.  

AWS security certifications such as SOC1 allow us to remain compliant with your data. Standards such as AES 256, which enables encryption of data at rest, ensures no one can view your data. Amazon Virtual Private Cloud allows us to create a private facing subnet for databases and application servers, in order to have more security control around your mission critical workloads.

  • 24/7/365 monitoring of up-time across the infrastructure.
  • Fully redundant internet connections.
  • Redundant Utility Feeds and power backed up by multiple UPS and power generators.
  • Objects are redundantly stored on multiple devices across multiple facilities within a region.

All ETO software servers are backed up nightly using Quest/Dell NetVault Backup software. For added security, the backup data is encrypted using AES-256 algorithm.

Nightly full backup of all ETO Data using AES-256 encryption algorithm.

The disaster recovery process is tested annually.

Maintenance Policy

The following services are provided exclusively to Customers who have executed an ETO™ Solution Order Form (“Order Form”) subject to a Master Services Agreement and are current in their payment for the ordered Services. Capitalized terms used but not otherwise defined in this Policy shall have the meanings given to them in the Master Services Agreement. SSG reserves the right to modify the technologies in this Policy provided they provide equal to or better protection of SSG’s servers or the Content.

  • Security: SSG will maintain standard 128-bit Secure Socket Layer (SSL) encryption. SSG’s servers will be protected by regular system-wide and Customer specific security audits. Operating system security releases are promptly installed and updated.
  • Data Backup: All servers are backed up daily to tape drive; SSG preserves the end of week tape which is securely stored off site. After 6 weeks, SSG preserves the end of month tape for historical purposes. If Customer’s data is lost as a result of the failure of hardware, Service or networks not directly controlled by SSG, SSG shall commence restoration within five (5) hours of notification from Customer and will use commercially reasonable efforts to restore Customer’s data as of the last archive.
  • Maintenance: SSG will use all commercially reasonable efforts to provide such error-correction services as may be required to ensure that SSG’s applications remain in substantial conformance with current functionality.
  • User-Support: SSG will provide such user support as may be required to promote the reasonable understanding and consistent use of the Service as currently configured. Standard user support is available via phone and email between the hours of 8:00 am and 8:00 pm, Eastern Standard Time, Monday through Thursday and Friday, 8:00 am to 6:00 pm Eastern Standard Time exclusive of holidays as may be established and amended by SSG from time to time.  SSG shall provide user support in accordance with Appendix A to this Policy.
  • Upgrades: SSG reserves the right to make such upgrades to the Service as may be necessary from time to time. Where applicable, SSG shall use commercially reasonable efforts to notify Customer and its Authorized End-Users of such upgrades within ten (10) business days of release and cause minimal user-level interruption. Where applicable, SQL Server and Microsoft Windows upgrades will be kept current with Microsoft-specified standards. Once deployed, these upgrades become functional components of the Service.
  • Call Management Process: SSG’s problem-ticket system will be used by all support team levels to record and track all problem reports, inquires, or other types of calls received by level 1 support.
  • Dependence on other Entities: SSG may be dependent on other entities to provide Customer with the services (i.e., help desk, database services, etc.), and external suppliers (i.e. Microsoft, System Source, etc.) in providing support services to Customer. SSG will manage the interface into those suppliers as it relates to the provision of services under this SLA. The list of organizations and vendors that SSG may be dependent on may be changed solely at the discretion of SSG.

The following are outside the scope of Maintenance and will not be provided unless there is an Order Form identifying the services and costs for providing them.  

  • Evaluation of new Service or hardware – Evaluation or approval of new Service or hardware for Customer’s internal use. This includes systems developed outside of the Website and Service, such as third-party systems, or systems developed by Customer.
  • Procurement of new Service or hardware – Procurement of new Service or hardware for Customer’s internal use, or for use by internal staff of Customer. All Service or hardware required for Customer to access SSG’s Services will be Customer’s responsibility.
  • On-call support management – SSG’s support managers are not required to be on call. If at a later date Customer requires the support manager to be on call for a specific purpose, or on a longer-term basis, then the support managers will be compensated at the then standard on-call rate, and the Customer shall be charged for this service.
  • Custom Reporting – SSG may, at its own discretion, meet a specific requirement for a report requested by the Customer. This effort will be billable at the then current rate and be outlined to the Customer before any work begins. This work will be scheduled strictly on a first come, first served basis. Additional charges may result if Customer requests an increase in the priority of their request.
  • Customer requested training – SSG will provide Customer requested training on a time and material basis. SSG training staff will be compensated at the then current rate for education by the Customer. SSG strongly encourages its Customers to take advantage of the free training provided by SSG on a regular basis through the support organization. SSG also offers recordings of some of its classes through its homepage (http://www.socialsolutions.com).
  • Upgrades to application Service and associated hardware – Periodically SSG will upgrade or will require an upgrade of an existing system or third-party Service housed at Customer’s site in order to maintain support. These upgrades may include a requirement for Customers to upgrade operating systems and/or browsers and other Service.
  • Assistance with Customer’s application usage – Advice about or education on how to use applications, including completing transactions, creating users within or for an application, or on the purpose of an application other than applications provided by SSG.
  • Assistance with Customer’s application environment support – Advice about how to use, maintain, and support application environments, including application development tools, application server Service, and databases other than applications provided by SSG.
  • Assistance with application usage when unsupported or nonstandard hardware or Service is involved – Use of unsupported or nonstandard hardware or Service often results in unexpected behavior of otherwise reliable systems.

Enterprise Administration – Defined as activities relating to the customization and use of SSG applications  for  use  by  the  Customer. Customer is required to provide a technical resource (“Enterprise Administrator”) to provide administrative support for SSG’s applications on an ongoing basis.  

Enterprise Administration Services – Should the Customer be unable to provide an Enterprise Administrator, SSG will provide such a resource on behalf of the Customer. This resource will be billable to the Customer at SSG’s then current rate for enterprise administration services.

New development – Any change in a database or system that involves functionality not within the current production version of the Service, even if the new functionality would seem to be an improvement over the old one.

 

Source : https://eto-articles.socialsolutions.com/en/articles/2958481-security-faqs

Contacts Us

Name
Address
MARIO GONZALEZ
Vice President of Workforce Training & Employment
Mario joined HBI as a Regional Career Development Coordinator of HBI’s Military Services in 2019 and was promoted to Associate Vice President of WTE Community & Corrections Programs in 2022.
 
Now serving as Vice president of WTE (2024), he oversees the daily operations of HBI’s WTE Community & Corrections, Military Services, & Academies programs, working with partners to advance HBI’s expansion and enhance job placement opportunities for graduates. Mario serves as the liaison between HBI and external stakeholders to include military installations. He ensures successful outcomes for HBI graduates from transitioning service members & veterans to justice involved adults & youths. Internally, he provides strategic operational perspective to HBI’s senior leadership team.
 
Prior to joining HBI, Mario served for 21 years in the U.S. Army across multiple locations globally & nationally and has an MBA from Trevecca Nazarene University in Nashville, TN.
 
Mario resides in Tennessee with his wife and children and spends time in Texas where his mother, adult children, and grandchildren reside. He enjoys the outdoors and serving in his community. 
JOSEPH F. LANDERS
Executive Officer of the Home Builders and Remodelers Association of Massachusetts

Joseph F. Landers, 71, is the Executive Officer of the Home Builders and Remodelers Association of Massachusetts having assumed that role in 2018 with a mandate from the Board of Directors to harmonize the five MA local associations, increase communications from the state to the membership, increase the public profile of the association, create a path to financial stability and elevate the states lobbying efforts. Prior to taking on the challenging state association role, Joe was Chief Executive Officer and founder of Customized Structures Inc., a custom manufacturer of single-family, multi-family and commercial modular and panelized structures which began operations in 1984. Joe has been involved in the building industry, both site-built and factory-built, since 1973 and has worked in all phases of construction from development through design and production including on site management and sales. Customized Structures produced on average 330 single family homes per year, had an employee base as high as 180 and was known as the innovator in the production and design of modular components.

 

After the sale of Customized Structures Inc. to a private equity firm in 2003 Joe remained on the Board of Directors of the Company and functioned as a consultant to the CEO. He further took on the role of helping failing building systems companies return to profitability and successfully oversaw the sale of those companies. Mr. Landers has lectured frequently on the benefits and utilization of systems-built construction to building professionals around the country and has utilized his substantial professional and industry background to provide consultation services to both national and foreign companies interested in the processes and pitfalls of building and developing utilizing building systems components.

Joe attended Northeastern University and St. Anselm’s College graduating with a B.S. in 1972. 

Joe has been a member of the National Association of Home Builders since 1974. He is past president of two local Home Builders Associations and has served two terms as President of the  State of NH Home Builders Association. Joe is also a past president of the Modular Building  Systems Council of the NAHB, has been Chairman of the National Building Systems Council (BSC)  and has served five terms as a Trustee of the BSC during which time he created the BSC logo and  wrote the brochure “Most Frequently Asked Questions about Modular Homes”. 

In 1989, Joe received the National Pacesetter Award in recognition of his outstanding leadership  and contribution to the housing industry and in 1991 was awarded the title of Builder of the Year  by the Home Builders Association of N.H. In 1992 he was appointed by the Governor to the NH  Board of Fire Control within the Department of Safety and since then was reappointed three times.  He has served as a member on the State of New Hampshire Building Code Review Board and was  appointed by the Governor of NH to the Shore Land Protection Commission. Joe was selected to  receive the 2000 S. A. Walters Chairman’s Award, the premier award in the U.S. Systems Built  Housing Industry and was installed to the New Hampshire Housing Hall of Fame for his significant  and lasting contributions to the housing industry in the State of New Hampshire.  

Joe is a Senior Life Director of the National Association of Home Builders; he is served six terms on the NAHB Budget & Finance Committee serving as Vice Chair for four of those years, he has served  as Chairman of the Resolutions Committee, the International Housing Committee and the Building  Products Issues Committee of NAHB serving on the NAHB Executive Committee multiple times. 

In 2001 Joe was elected an Area Vice President of the National Association of Home Builders  representing builders through out the northeast. 

Joe is active in his community having served as finance chairmen of his church, is a member of the  International Order of Odd Fellows, and has served on multiple boards and committees on a  volunteer basis.  

Joe and his wife, Denise, reside in Plymouth, MA, they have two children, Jessica and Brad and two  grandchildren, Lily and Jack ages 13 and 11.

Seth Appleton
President of U.S. Mortgage Insurers

The Honorable Seth Appleton is President of U.S. Mortgage Insurers. In this role, he leads USMI’s efforts to enable sustainable access to affordable mortgage credit for borrowers while protecting taxpayers. Seth previously served as President of MISMO, the real estate finance industry’s standards organization. Prior to that, Seth served as the Assistant Secretary for Policy Development and Research at the U.S. Department of Housing and Urban Development (HUD),
a position for which he was unanimously confirmed by the United States Senate. In addition to his service as Assistant Secretary, Seth concurrently served as the Principal Executive Vice President of Ginnie Mae, a government corporation guaranteeing the timely payment of
principal and interest on more than $2 trillion in mortgage-backed securities.


Before joining HUD, Seth worked on Capitol Hill, including serving as Chief of Staff for U.S. Congressman Blaine Luetkemeyer for more than eight years. A native of Missouri, Seth is a graduate of Stanford University and is a co-chair of the Bipartisan Policy Center’s Housing Council.

Zach Harris Story Card - HBI Build Strong Academy New Orleans Graduate