Silverpop uses a multifaceted approach to mitigate risk and maximize security in support of data privacy and business continuity. We understand that the integrity and security of our clients' data is important to the success of their business and ours. To keep up with the evolving demands of security, Silverpop is constantly evaluating and improving our applications, systems and processes.
Client Security Controls
- Define the IP address individual users are allowed to log in from
- Control user actions post-login with multiple permission levels, including:
o User interface access rights
o API access rights
o Individual access rights (add/update/delete contacts, export lists, etc.)
o Functional access rights (send mailings, view reports, administrative, etc.)
o File/Folder access rights
o Database access rights
- Password settings can be configured to mirror each client's own corporate security practices
- Control user access with two-factor authentication (optional)
Application Security
- Client data is isolated to its own database
- A layered platform approach keeps client data separate from the application
- An audit trail is maintained of user actions performed on the system
- Passwords are stored and encrypted
Secure Transmission and Sessions
- Connection to the Silverpop environment is via SSL 3.0/TLS 1.0, ensuring that our users have a secure connection from their browsers to our service
- Individual user sessions are identified and re-verified with each transaction, using a unique token created at login
- Restrict organizational-level access by IP address
- SFTP and 128-bit encryption for FTP file transfers with additional VPN and PGP encryption protection available
- Two-factor authentication required for all communications with Silverpop data centers
Network Protection
- Perimeter firewalls and edge routers block unused protocols
- Internal firewalls segregate traffic between the application and database tiers
- Intrusion prevention and detection sensors report events to a security event management system for logging, alerts, and reports
- Internal access control lists segregate traffic between the application and database tiers
- A third-party service provider regularly scans the network externally
Internal and Third-party Testing and Assessments
Silverpop tests all code for security vulnerabilities before release and regularly scans our network and systems for vulnerabilities. Third-party assessments are also conducted regularly:
- Application vulnerability threat assessments
- Network vulnerability threat assessments
- Selected penetration testing and code review
- Security control framework review and testing
Security Monitoring
- Our Information Security department monitors notification from various sources and alerts from internal systems to identify and manage threats
Secure Data Centers
Our service is collocated in dedicated spaces at top-tier data centers. These facilities provide carrier-level support, including:
Access control and physical security
- 24-hour manned security, including foot patrols and perimeter inspections
- Biometric scanning for access
- Dedicated concrete-walled data center rooms
- Computing equipment in access-controlled steel cages
- Video surveillance throughout facility and perimeter
- Buildings engineered for local seismic, storm and flood risks
- Tracking of asset removal
Environmental controls
- Humidity and temperature control
- Redundant (N+1) cooling system
Power
- Underground utility power feed
- Redundant (N+1) CPS/UPS systems
- Redundant power distribution units (PDUs)
- Redundant (N+1) diesel generators with on-site diesel fuel storage
Network
- Concrete vaults for fiber entry
- Redundant internal networks
- Network neutral; connects to all major carriers and located near major Internet hubs
- Disparate network entry points (from opposite ends of the building)
- High bandwidth capacity
- Full redundancy on all core network equipment: switches, firewalls, server network interfaces and load-balancers
Fire detection and suppression
- Redundant (N+1) Very Early Smoke Detection Apparatus (VESDA) protection
- Dual-alarmed, dual-interlock, multi-zone, pre-action FM200 gas fire suppression system backed by a dry pipe water-based system
Disaster Recovery
- Silverpop performs cross-data center replication for disaster recovery
- Data is transmitted across encrypted links
- Disaster recovery tests verify our projected recovery times and the integrity of client data
Backups
- All data is backed up to disk at each data center on a rotating schedule of incremental and full backups
- Data is replicated to other data center via an encrypted tunnel
Regulatory Compliance
- Silverpop has Safe Harbor certification
- Our data center providers have annual SAS70 Type II audits
