ÌìÃÀÍøÕ¾´«Ã½´«Ã½

Data encryption

ÌìÃÀÍøÕ¾´«Ã½´«Ã½ uses strong encryption when transmitting data over public networks, including the use of TLS 1.2 and 1.3 protocols, AES-256 encryption and SHA signatures. This is the standard internet communication encryption used by all e-commerce sites, banking and other high security web-based systems.

We use AWS RDS encryption (we encrypt our database and snapshots). Amazon RDS encrypted instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS instance.

Backups

ÌìÃÀÍøÕ¾´«Ã½´«Ã½ maintains nightly backups of all data, database and customer specific files. We maintain redundant copies at a second Canadian hosting provider. In the event of any data loss, we are able to restore our database and other data from these backups. Our development operations team practices data recovery regularly.

Penetration testing

ÌìÃÀÍøÕ¾´«Ã½´«Ã½ regularly performs application and infrastructure penetration testing. Our security and development team review and prioritize any reported findings. All critical and high priority issues are resolved before being released to our production environment.

Network security

ÌìÃÀÍøÕ¾´«Ã½´«Ã½ maintains separate network environments to protect more sensitive data. Systems supporting testing, development, marketing, customer results sites and our corporate network are separate from our production systems. Administration access to our production systems is limited to our development operations team.

Authentication

Where possible, ÌìÃÀÍøÕ¾´«Ã½´«Ã½ uses multi-factor authentication. This includes administration access to production systems, 3rd-party SaaS providers and internal business systems. ÌìÃÀÍøÕ¾´«Ã½´«Ã½ encourages employees to use an approved password manager to create complex, unique passwords for all systems and services they use.

The ÌìÃÀÍøÕ¾´«Ã½´«Ã½ application requires a strong password and is rate limited to prevent against possible attacks.

System monitoring, logging and alerting

ÌìÃÀÍøÕ¾´«Ã½´«Ã½ actively monitors servers, workstations and mobile devices for possible vulnerabilities and attacks. We maintain user activity logs, server logs and audit logs for all systems. Alerts are examined and acted upon based on priority.

Virus scanning

When files are uploaded into the ÌìÃÀÍøÕ¾´«Ã½´«Ã½ application, they are scanned by our redundant ClamAV instances before they are made available. If a virus is detected, the file is quarantined and a replacement file is put in place to let the exchange leader know to contact our support team. Virus definitions are updated hourly.

Endpoint monitoring and computer security

ÌìÃÀÍøÕ¾´«Ã½´«Ã½ workstations run monitoring tools that can detect malware, virus activity and unsafe configurations. Workstations are required to encrypt data, have strong passwords and lock when idle. Our IT team monitors alerts and resolves any significant issues based on priority.

Mobile device management

Mobile devices that are used at ÌìÃÀÍøÕ¾´«Ã½´«Ã½ are centrally managed and required to be enrolled in our mobile device management system.

Data confidentiality

Our subscription agreement and terms of use require us to maintain the confidentiality of all ‘information’ provided by our customers. This ‘information’ includes both content stored in the ÌìÃÀÍøÕ¾´«Ã½´«Ã½ application and ‘information’ provided to us by our customers in phone calls, meetings, email, etc. More information can be found in our .

Protected data and personally identifiable information

ÌìÃÀÍøÕ¾´«Ã½´«Ã½ maintains policies regarding data security and individual privacy protection. We protect our customers’ and participants’ data with the same care as we protect our own confidential data.

ÌìÃÀÍøÕ¾´«Ã½´«Ã½ has internal controls in place to ensure protected data is safeguarded in accordance with applicable laws based on country, state and provincial regulations, including, but not limited to GDPR, PIPEDA, FERPA, CIPA, PPRA and COPPA.

Participant privacy and terms of use

Our include our privacy policy for participants’ information.

In summary, our privacy policy is that participants’ input (thoughts, stars or other data they provide) can be made public as part of our process; their identity (email address, name and other identifying information) is shared between our customer and ÌìÃÀÍøÕ¾´«Ã½´«Ã½. The association of identity to input (i.e. who said what thought) is kept private by us, except as required by legal considerations.

Data removal

Customer and participant data can be removed upon request by contacting our support team. Backups are purged every 30 days. ÌìÃÀÍøÕ¾´«Ã½´«Ã½ relies on our hosting providers to remove data from disks used by ÌìÃÀÍøÕ¾´«Ã½´«Ã½ before they are repurposed.

Information security incident management

ÌìÃÀÍøÕ¾´«Ã½´«Ã½ maintains security incident response policies and procedures covering initial response, investigation and customer notification. We review these policies annually.

Breach notification

ÌìÃÀÍøÕ¾´«Ã½´«Ã½ makes its best efforts to protect your data; however no method is perfect, and we cannot guarantee absolute security. If ÌìÃÀÍøÕ¾´«Ã½´«Ã½ learns of a security breach, we will notify all affected users. Our breach notification procedures are consistent with our country, state and provincial obligations.

3rd-party suppliers

ÌìÃÀÍøÕ¾´«Ã½´«Ã½ relies on 3rd-party suppliers like Amazon Web Services, Microsoft Azure and Sendgrid to provide our services. ÌìÃÀÍøÕ¾´«Ã½´«Ã½ ensures that our suppliers adhere to our data and confidentiality agreements and perform reviews annually.