social.plus Security Overview
Our mission is to empower people and companies with the tools they need to do their best work. As an enterprise product, security is a high priority at social.plus, and we have ensured that it was built into our company’s DNA from day 1. We believe in a holistic view of security, such that effective security is centered around the effective integration of people, process, and technology. This page describes our efforts in securing each of these pillars.
Organizational security
Our security program is aligned to the ISO/IEC 27000 standards and is regularly assessed by third party auditors and customers. social.plus is ISO/IEC 27001:2013 certified and compliant with the requirements as stated in the standard: ISO/IEC 27001.
Policies and standards
social.plus internal IT Security Policy and Data Protection Policy provide all employees with clear guidelines and boundaries for operation within social.plus. These policies are designed to ensure that all social.plus customers have confidence in our custodianship and management of their data. These policies include, but are not limited to:
- Data classification & handling processes
- Secure development lifecycle & change management
- Use of encryption
- 24/7 monitoring
- Disaster recovery & business continuity processes
Data security
All social.plus systems are designed with a focus on preventing unauthorized access to customer data, using the latest security best practices and technologies. Additionally, we continuously test and re-evaluate our systems on a regular basis, in order to proactively identify and mitigate potential risks.
Encryption
All data going through social.plus is encrypted in-transit. Data in-transit is always encrypted with the latest TLS 1.2 protocol, a security protocol widely known and used for encryption of personal information in the e-commerce and banking industries. All data stored in social.plus is encrypted with AES-256 encryption.
Privacy Controls
social.plus proactively provides additional controls to make sure sensitive company data is not leaked. As one example, social.plus will let employees know if they start a conversation with someone outside the official company network. When working with very sensitive data, you can also use our message editing and deletion features to easily ensure that any message is permanently deleted from everyone’s devices.
Audit Controls
social.plus provides mechanisms that record and examine all activities on any part of the system which contains customer data. Our cloud servers have account monitoring in place that logs any user activity. Additionally, every message or piece of data sent over social.plus will also contain traceable, detailed delivery and receipt information that can be easily accessed on the client side; every action performed within social.plus by users is also securely logged, and can be requested by the company at any time.
Application Security
social.plus was developed, and is continuously updated, according to OWASP’s best practices, with regular security audits conducted by an outside party. We utilize world-class CDN providers on all our endpoints for our DDoS protection and firewall protection. We also use IP reputation filtering, intrusion detection and prevention systems at all our underlying infrastructure.
Secure Data Center
social.plus servers are hosted with Amazon Web Services (AWS) in their Frankfurt, Singapore, and North Virginia regions. AWS is a global data center & cloud computing provider with secure locations all over the world. social.plus data centers are SSAE16 SOC1 / SOC2 / SOC3 and ISO 27001 compliant. This means our physical servers all have 24/7 video surveillance, biometric locks, and strict personnel access controls.
- ISO 27001 Security Certificate
- More information about our infrastructure provider.
Reliability & Availability
social.plus application and databases are designed with scalability and high reliability – all components are deployed with no single point of failure. social.plus data centers include an on-premise backup power supply. Additionally, your data is backed up nightly.
GDPR
At social.plus we are fully committed to being compliant, where applicable, with the provisions of GDPR and to help our customers and users to understand this regulation. Hence, the goal of this GDPR Commitment is to explain what steps we took - and what we will take in the future - to ensure and maintain a secure and compliant environment for our customers and users under GDPR. For more information please refer to our GDPR Commitment.