Technical security
Are development, test and production environments segregated?
Yes. Development, testing, staging and production environments are segregated.
Is data encrypted both at rest and in transit?
Yes. Access to our websites, applications and APIs is always secured with HTTPS. Our databases, backups, logs, caches and other storage where we keep customer data are encrypted at rest. Where applicable, intra application communication is also encrypted.
Technical details
At rest AES-256 encryption is used
Transit in and out is always HTTPS encrypted with TLS 1.2 or above (RSA with AES128-GCM-SHA256)
Intra-application transit, inside our production network is AES-256 encrypted
Will you require any access to the customer's internal network?
No.
Do you have an Intrusion Detection System (IDS), Intrusion Prevention System (IPS), Web Application Firewall (WAF) or DDOS protection in place?
Yes, we employ all of them, along with many other technical controls.
What kind of physical security controls do you have at your offices?
Electronic keys assigned only to authorized personnel, alarm systems.
How do you identify vulnerabilities and remediate associated risks?
Continuous penetration testing, automated network and vulnerability scans, dependency scans, container scans, infrastructure monitoring, human observations. Technical vulnerabilities are handled in accordance with the Vulnerability Management Policy. Other than technical vulnerabilities are handled in the risk management process.
What controls are in place to protect against malicious code?
Automated network and vulnerability scans, dependency scans, container scans, infrastructure monitoring. Malware protection (EDR) solution deployed to endpoints.
Do you use any open-source software as part of providing your services?
Yes, we use an extensive amount of open-source components as part of our software from Ruby on Rails to Kubernetes. We have an Open Source Policy, which entails e.g. the accepted licenses.
What kind of security controls do you have on your endpoints?
The following controls are enforced with an MDM solution to all company endpoints: automated security updates, screen lock after 10 minutes inactivity, full disk encryption, antivirus (EDR) solution.
Are system and security patches applied to workstations and servers on a regular basis?
Yes, automated updates enabled on all operating systems where feasible, enforced with management solutions. In addition to technical capabilities, newsletters are followed to address potential zero-day finding workarounds while waiting for official patches.
What kind of measures do you have in place to ensure the rapid restoration of the availability of data after its interim loss or damage?
Production infrastructure is built on fault-tolerant systems that ensures customer data is stored redundantly across multiple data centers (AWS availability zones). Backups are taken regularly and backup restoration tests are conducted at least annually.
What availability guarantee do you offer? Do you have a public status page?
Leadfeeder provides the Services as defined in our General Terms and Conditions (GTC), paragraph 4.12. Our public status page with a status update subscribe opportunity is available here: https://status.leadfeeder.com
Do you have a bug bounty program or do you conduct timely penetration tests?
Yes, we run a private bug bounty program on HackerOne, where ethical hackers do continuous penetration testing against our defined assets. The latest report is available here.
Do you vet applications and browser extensions installed on endpoints?
Yes, we have a process to vet both applications and browser extensions.
Security governance
Do you have a formal staff on-boarding process covering security and privacy aspects? After on-boarding, do all workforce members undergo security awareness training on a regular basis?
All personnel receive security and privacy training at on-boarding and they must complete a refresh training on an annual basis. In addition, we do continuous phishing simulations and offer self-learning materials. Further role-specific training is offered based on risks.
Do you have a set of written policies, plans and procedures governing information security and privacy? Can you share copies of these?
Yes, we have a set of policies which are audited by an independent third party as part of the ISO 27001 and ISO 27701 certification audits. You can find the certificate files, our Information Security Policy (which references our other policies) and our Legal Kit in the Leadfeeder Compliance Hub.
Are staff members required to sign an NDA?
Yes, this is part of our work contract signing process.
Do you have a policy for managing access to the program source code?
Yes, we have an Access Management Policy, which governs all access management including program source code.
Do you have a formal encryption policy?
Yes, we have an Encryption Policy. All end user device and server disks must be encrypted, all traffic must be encrypted, including communications with external systems.
What are your network security practices for your office locations?
Our office networks do not have any elevated access to any production systems, access requires a separate VPN connection terminated in the production data centre (AWS). We employ firewalls and have WPA2 on Wi-Fi provided in the offices.
What are your network security practices for data center locations?
AWS VPC, firewalls (security groups) with minimal access b/w instances. Operator access only via VPN.
Do you have a formal Software Development Life Cycle (SDLC) and Secure Development Policy?
Yes, both are audited by an independent third party as part of the ISO 27001 and ISO 27701 certification audits.
What secure coding guidelines do you follow as part of the application development?
In addition to Software Development Life Cycle (SDLC) Policy and Secure Development Policy we follow OWASP TOP 10 and framework specific best practices.
What guidelines do you follow for building and maintaining AWS infrastructure?
In addition to hiring only AWS experts in their field, we follow AWS Well-architected guidelines.
Do you outsource any aspect of your security or privacy program?
Yes, bug bounty program / penetration testing is sourced from HackerOne.
Do you have policies in place to ensure a safe work environment?
Yes, we have work safety policies in accordance with local laws.
Do your workforce members have a way to anonymously report misconduct?
Yes, we employ a whistleblowing solution to report misconduct anonymously.
Do you have a formal vendor assessment policy and process?
Yes, we have a Vendor Management Policy that is audited by an independent 3rd party as part of the ISO certification audits. Furthermore, we vet applications and browser extensions installed on our endpoints.
Do you have a data classification policy?
Yes, we do classification in two ways:
We classify personal / non-personal data in accordance with applicable laws and regulations
Information, such as documents, are classified as Public, Internal, Confidential or Restricted based on the information sensitivity.
--
Questions, comments, feedback? Please let us know by contacting our support team via the chat or by sending us an email at support@leadfeeder.com.