Security at Condati

Condati takes the security of your data seriously. We strive to stay current with or ahead of industry best practices with respect to confidentiality, application security, and availability, and the summary of our approaches in those areas is described below.

Condati is committed to ensuring that client data is not seen by anyone who does not have access authority. We place the strictest controls over our employees’ access to the data you and your users make available via our service, as more specifically defined in your Terms of Service agreement with Condati.

Internal Security Council

Condati maintains an internal Security Council to review both technical practices and business requirements. The Council meets regularly to review and improve our practices, examine our operating environments, and oversee the security-related tasks performed and/or features implemented by the conDati engineering security team.

Personnel Security

All Condati employees and contract personnel are bound to and obligated in writing to our policies regarding use of client campaign performance data (hereinafter referred to as “client data”), and we treat these issues as matters of the highest importance. Each employee receives a security background check prior to hire, and when employees or contractors terminate their relationships with Condati, their access to Condati systems and client data is immediately suspended.

Penetration Testing

Condati employs a global cyber-security and risk mitigation firm to conduct code-assisted penetration testing on our product stack. Code-assisted means that we give the firm our source code in order to help them in their attempts to gain access to our product. Penetration testing results have shown no critical or high severity issues and attackers were unsuccessful in attempts to gain unauthorized access to the application or any associated infrastructure. Additionally, once access was granted via user credentials to a specific area of the platform, it was impossible to gain access elsewhere in our platform due to the siloed design of our product architecture and security first approach to building products. A copy of our latest penetration report is available to our customers upon request.

Single-Tenant Architecture

Each of our customers has their own dedicated and isolated environment running conDati RevenueLift™. Condati’s data warehousing architecture is based on Snowflake’s single-tenant data warehouse. Data from all of Condati’s clients is kept in individually protected source locations. This approach prevents “data leakage” between any application or storage instances.

No Use of Personally Identifiable Information

The Condati service does not collect, store, use, or analyze any personally-identifiable information (PII), such as the names, emails, phone numbers, or any other individual information about your prospects and customers, again as described in your Terms of Service Agreement with Condati. We ask that you do not provide us with access to any PII data, and we will delete any such data from our systems should it be encountered.

Data Encryption

Condati services support the latest recommended secure cipher suites and protocols to encrypt all data traffic in transit. Client data is also encrypted at rest.

Single Sign On

Condati products can integrate with a variety of single-sign-on providers. Teams can enable Google Apps for Domains as their authentication provider, and teams can also enable SAML 2.0 SSO or Open ID Connect with providers such as OneLogin, Okta, Centrify, and Ping Identity.

Need-to-Know Data Access

The operation of Condati services occasionally requires that designated employees have access to the systems that store and process client data. Examples of the need for this kind of designated access include resolution of technical issues, configuration of data APIs from your source systems to Condati’s services, and application of Condati’s machine learning algorithms to your data for purposes of creating specific visualizations on your behalf. All employees are prohibited from using these permissions to view client data unless it is necessary to do so for development, engineering or problem resolution purposes. We maintain technical controls and review in-place policies to ensure that any and all access to client data is logged and validated.

Access to Source Systems

The nature of Condati’s services requires that you provide us with access authority and credentials to your source systems. These credentials are used only for the purposes of onboarding your data to the Condati service, and then preserving real-time access for our analytical services regarding your systems. The only Condati employees who have access to them are the data onboarding team, and they are kept under the tightest access control and access logging that we can provide. Condati assumes no other obligation with respect to the security of the data that comes from these systems, and you should ensure that your security practices remain in place at all times. Security practices by the vendors of these systems can be found at their respective websites, including Google, Adobe and Facebook, et al.

Minimum Access

When you grant us credentials to your source data systems, we only ask for the minimum level access from each source required to load your data. In most cases, this will be read-only access.

HTTPS

Condati always uses HTTPS, rather than HTTP, for our own systems and applications. We cannot control protocols used by other vendors, but when accessing your data in other systems, Condati will always use HTTPS if it is available.

Infrastructure Security

The data warehouse that contains client data is provided by Snowflake, Inc., which maintains multiple security certifications for their Condati-related services and practices. For more information about their certifications and compliance, please visit the Snowflake Data Warehouse Security pages.

Condati services are hosted by Amazon Web Services, which maintains multiple certifications for their data centers, including ISO 27001 compliance, PCI Certification, and SOC reports. For more information about their certifications and compliance, please visit the AWS Security website and the AWS Compliance website.

Availability and Disaster Recovery

We understand that you rely on Condati services to work. We’re committed to making Condati a highly-available service on which you can depend. Our infrastructure runs on AWS systems that are fault tolerant, including failures of individual servers or even entire data centers, to ensure availability. Client data and our source code are automatically backed up nightly. The Condati operations team is alerted in the event of any failure with this system. Backups are fully tested frequently to confirm that our processes and tools function as expected.

Network Protection

Firewalls are configured according to industry best practices and unnecessary ports are blocked by configuration with AWS Security Groups.

Logging

Condati maintains system logging for its production environments which contain information pertaining to security, monitoring, availability, access, and other specifics of Condati services. Condati maintains detailed access logs for all our services. We log every time an account signs in, noting the IP address of the connection. These logs are reviewed for suspicious security events and are consistently overseen by the security team.

Deletion of Access to Client Data

You may revoke Condati’s credentials to your source data systems at any time, either permanently or temporarily. Condati also provides the option for clients to request the deletion of client data at any time during a subscription term. Within 24 hours of authorized initiated deletion, Condati hard deletes all information from currently-running production systems. Condati services backups will then be destroyed within 14 days. These actions may be taken with or without cause or explanation, but they do not relieve you of your obligations under your Terms of Service agreement with Condati.

Application Security by Design

All new Condati features, functionality, and design changes go through security review during the design process that is facilitated by the security team. In addition, our code is manually peer-reviewed prior to deployment to production status.

Incident Management and Response

In the event of a security breach, Condati will promptly notify you of any unauthorized access to client data. Condati maintains the email address security@condati.com for all security-related inquiries.

A Serious Security Commitment

We take security seriously at Condati , because every person and marketing team using our service expects their data to be secure and confidential. Protecting this data is a critical responsibility we have to our clients, and we work hard to maintain that trust.