Security
Our commitment to security and trust
ChannelDock is committed to protecting the confidentiality, integrity, and availability of customer data. Security is part of how we design, operate, and support the ChannelDock service. This page describes the commitments we publish for customers, partners, and other stakeholders.
Technical and organizational measures for data handling are also described on our data protection page. How we process personal data is described in our privacy statement. Vendors that process data on our behalf are listed on our subprocessors page.
Organizational security
Information security program
We maintain an information security program that is communicated throughout the organization. The program follows the criteria set forth by the SOC 2 framework, a widely used information security auditing standard created by the American Institute of Certified Public Accountants. Roles and responsibilities for the program and for the protection of customer data are defined and documented. Team members are required to review and accept our security policies.
Security awareness and confidentiality
Team members complete security awareness training covering industry-standard practices, including phishing and password management. Team members are required to sign and follow a confidentiality agreement before they start work. Where permitted by local law, we perform background checks on new team members.
Assessments
We assess security and compliance controls, including independent review of those controls, and we perform vulnerability scanning and ongoing monitoring for threats. We carry out risk assessments at least annually, including consideration of fraud risk.
Cloud and data security
Hosting
Our main database and customer feeds are stored in DigitalOcean data centers in Europe. Those facilities maintain their own security program and certifications. More information is available in DigitalOcean’s certification reports.
Encryption
Data is encrypted in transit using modern TLS and strong cipher choices. Data is encrypted at rest, including the disks in our data centers.
Logging, backups, and recovery
Actions in the product are logged in a structured format for auditing. Server logs are centrally aggregated so we can detect anomalies, and we keep performance statistics for our infrastructure. We back up data regularly, both on-site and off-site, excluding personal data that we anonymize on a shorter schedule. Backups are encrypted and stored in a physically secure facility. We test restoration so we can recover in the event of a failure, and we monitor for failures that affect customers.
Retention and deletion
By default, ChannelDock anonymizes customer personal data handled for order connections after 90 days. Amazon personal data is retained for less than 31 days. Data deletion follows industry-standard NIST 800-88. We retain only the information needed to keep the service operating correctly. Our privacy practices follow the EU General Data Protection Regulation (GDPR).
Access security
Access to cloud infrastructure and other sensitive tools is limited to authorized team members who need it for their role. We follow the principle of least privilege. Where available, access to cloud services is protected with single sign-on, multi-factor authentication, and strong password requirements. Team members use a password manager. We review access to sensitive systems on a quarterly basis and remove access that is no longer required.
Vendors
Before we authorize a new vendor, we assess the risk and complete the vendor review appropriate to that risk. Changes to subprocessors are published on our subprocessors page.
Incident response
We have a process for handling information security events. It includes escalation, rapid mitigation, and communication with affected customers where their data is involved.
Contact us
Questions about these commitments, or a suspected security issue, can be sent to [email protected]. Please contact us as soon as you can if you believe you have found a problem.