Is my data secure in the cloud, what protection does Apptivo offer?

With Apptivo you can rest assured that we have you covered when it comes to secure management of your business systems.  Especially with recently evolutions in security law around the world, it’s paramount that businesses ensure the security of their user and customer data through their own internal practices and those of their vendors.  Here at Apptivo, we understand the trust you place in your business software platform to lead the charge when it comes to ensuring your data remains protected.

Apptivo is SSAE16 certified, EU-U.S. privacy shield compliant, and GDPR compliant.

This means we take your security seriously, and have done the work to prove it.

For this document, we’ll dive into the details of each layer in our security and provide most details required by any business owner or IT manager to properly vet Apptivo has a software vendor.  In general when looking at security Apptivo breaks apart protections into two categories:

Internal Threats – Having data improperly accessed, exported, or deleted by a user of the system, such as a disgruntled employee deleting all of the business data. Our platform security features explain how your company can design a secure system and mitigate these risks.

External Threats – These are threats related to outside parties like hackers, who may attempt to compromise the system or business data. These threats are mitigated by strong IT policies and systems administration, which Apptivo takes care of for you.  Below we’ll detail our certifications, network infrastructure, and basic IT security policies designed to protect your data.

Policies & Certifications

Apptivo has a robust system of security & privacy policies verified by both internal resources as well as third parties.  These policies are reviewed and updated at least once a year, with the last review being in June 2018.

General Data Privacy Policy

Apptivo follows the principles of EU Safe Harbor and other Privacy domains. We don’t collect any data from users for our use, except during the payment process which is pretty typical for all web-based services. All other information including a user's location, email and phone number are needed only for those users to run their business on our platform. For example, if they need to print their address, email and phone number on their proposals or invoices. Apptivo never uses information provided by our users and hence does not mandate users to provide any of that information. All PII and sensitive information are completely optional.

Apptivo does not provide any of our client data to third parties. Our policies clearly indicate that clients own their data and we never intend to use their information. We do make an exception to this policy and indicate clearly in our terms of use that we may be forced to share client data with law enforcement in accordance with appropriate legal procedures.

GDPR Compliance

Apptivo is fully compliant with GDPR regulations to be used by companies in Europe (and worldwide) so they can provide that same commitment to their customer privacy.  We have formed a team dedicated to managing all data privacy-related inquiries or issues and is also there to support you in your compliance requirements with the guidance you may need for your DPIAs (Data Protection Impact Assessment).  

You can find the complete details of our terms of use & privacy policy here, which includes all required policies within the GDPR framework. If you have any questions about data privacy please let us know at privacy@apptivo.com.

Click here to view our Data Protection Addendum (DPA). 

EU-U.S. Privacy Shield Compliance

The EU-U.S. Privacy Shield Framework is designed as an additional set of commitments that Apptivo makes to ensure the privacy of your data is upheld.  This goes above and beyond the required GDPR regulations and is something that Apptivo voluntarily participates in.  You can view Apptivo’s Privacy Shield status here.

SSAE16 Certification

Apptivo utilizes a third party to audit our processes for SSAE16 compliance. The most recent audit was completed in February  2018 and the next review is February 2019.  Apptivo’s most recent certification was for SSAE16 SOC2 compliance.

Third-Party Vulnerability & Penetration Testing

Apptivo utilizes Symantec and Qualys for malware and vulnerability scans. The malware scans are done on a daily basis and the Qualys scans are done on a weekly basis. We also do on-demand Qualys scans as needed.

Data Ownership & Deletion Policy

In short, all data is owned by the client and can be deleted on demand at any time.  Apptivo supports a self-delete feature for each account.  At this time all business data will be deleted and cleared from rolling backups shortly after.  Otherwise, Apptivo retains basic contact & administrative data, but no client business data.  In compliance of GDPR Apptivo supports the “right to be forgotten” by emailing privacy@apptivo.com with a request to delete such sales data.  A customer is responsible for managing & deleting their own business data if desired.

For complete details on data ownership please refer to our privacy policy.

System & Network Infrastructure

Apptivo utilizes 3-tier architecture; web, application and data storage. The systems are secured behind a pair of perimeter firewalls working in an active/standby mode. These firewalls also serve as IDS and IPS. The web tier is on a pair of load balancer appliance. The application and data storage is running on Linux servers. The communication between the layers and to-and-from the internet is encrypted with SSL.

The logical access for systems & database administrators is allowed only to the jump servers, which can be accessed via VPN from the internet. Servers can be accessed only by SSH with username, password and key file from the whitelisted IP's.

There are no private connections established for any clients or the service providers. The connection to third-party service providers is established over the internet with SSL encryption.

Hosting Infrastructure

Apptivo’s production environment is hosted in Fremont, CA where it is collocated at a Hurricane Electric data center.  Hurricane Electric operates the largest IPv4 and IPv6 transit networks globally, offering quick transmission of business data worldwide.  All physical access is restricted by biometric security with 24x7 on-site monitoring & security.  All business data is stored within this primary location, which is a tier 2/3 data center.

Other than business data, Apptivo uses Cachefly as our content delivery network (CDN).  This service distributes all of the support code (javascript / HTML) and image resources required by Apptivo but does not store or transmit any business data whatsoever.  Cachefly has servers located all around the world to further decrease loading times.

Disaster Recovery Capabilities

Apptivo systems operate with a continual rolling backup at a maximum interval of 1 hour for every business account.  This data is encrypted and transmitted to our DR storage and application environments with hosted Amazon.

We use AWS East zone as our disaster recovery environment.  All data is stored encrypted at rest within Amazon S3 buckets, and access is limited onto to our DR AWS account.  We have a minimal set of infrastructure designed to mirror a segment of the production environment at Hurricane Electric.  This includes required firewalls, load balancers, as well as application and database servers.

In the event of a disaster which makes the production environment, unaccessible Apptivo will initiate the process to bring the DR environment online with the latest data backups.  Our most recent recovery process took about 8 hours to complete.

Data Encryption

All access to data is provided only through our web, mobile, or API applications.  Every connection to the Apptivo service must be secured by a 256-bit SSL encryption.  All data is encrypted in transit, then decrypted to be stored at rest.  User passwords used to authenticate with Apptivo will be salted and hashed and stored in their encrypted form at rest.

Data Segmentation Between Clients

All data is carefully segmented between each client.  Apptivo operates multiple multi-tenant platforms within our infrastructure.  Standard customers are allocated into a series of sharded databases designed to hold a specified amount of business data.  Every record of business data is assigned a unique identifier and tagged to the specific organization it belongs to.  For enterprise clients, Apptivo is able to deploy completely segmented databases which can house one or many tenants from a single client.

Platform Security Features

User Authentication & SSO

The standard Apptivo authentication requires an email address and password for each user.  A user can request a password reset on their own, or an administrator can send a password reset request directly to them.  Additionally, an administrator has control to disable the user’s ability to reset their own password and enforce the usage of SSO.

Standard SSO Integrations

Apptivo has multiple out-of-the-box SSO capabilities.  We currently integrate with Office 365, G Suite, and PayPal.  The Microsoft and Google services will function with both the consumer and business class products to provide authentication.  This includes the ability to log in from the Apptivo mobile and web apps, and we also have an installable app for G Suite/O365 which places an SSO link within their Google/Microsoft web interface.

Custom SAML Authentication

For enterprise clients, Apptivo has the ability to integrate with any SAML authentication system, such as Microsoft ADFS which can be integrated using SAML 2.0.  This custom authentication system is not available in typical Apptivo deployments and must be requested and implemented individually by the client.

Session Management Controls

Our application has a configured session length for each company.  The default session timeout is set to 11 days, and then firm administrators can change this from their business settings.  For companies using SSO, it’s recommended to sync the Apptivo timeout with your SSO service.

Role Based Access Control

A security role is a “profile” that contains a list of specific actions, or privileges that a user can perform. These roles can then be assigned to employees, allowing admins to set up the same level of access for similar employees. One employee can have one or many roles.

A privilege is a single specific action that can be performed and is specific to one app. For example, one basic privilege is “View Contacts”. This privilege allows a user to search & view the details of any contact, but not create, update, or perform any other action. There are a basic set of privileges in each app: Access (Add from App Store), View (read-only), Manage (create/update). Additionally, you can create custom privileges in each app, which come into effect when limiting access to features, fields, and special actions. We’ll cover these in detail below.

System administrators will perform all of the configurations of your roles & privileges in the Employees App settings area, then assign these roles directly to employees in the same app. There are a series of default security roles & privileges available in each app when you sign up, but you can disable/customize these at any time in the settings area.

Data-Level Access

Data level access is an additional layer of security over access roles. Enabling this setting will restrict access to the individual object, based on whether all users are assigned to that object, or whether they manage a particular person assigned to that object.  For example, an organization might have a sales organization with 2 teams of 5 people, each managed by a sales manager, and all lead by a sales director.

This feature enables the sales director to view all records, each sales manager could view their own and their team’s records, and each sales rep could view only their own records.  This feature can be turned on or off within each app that supports it individually.

Collaboration Security

While data level access controls access to specific records in each of the apps (leads, contacts, cases, etc), collaboration security is the similar concept but applied to the common apps.  Collaboration security determines how emails, calendar events, and tasks are shared among employees.

This allows you to keep these objects private to the user and administrators or can be turned into “collaboration mode” which will share these records between users.

Report & Action-Level Security

Nearly every button, link, report, or action within the system can be restricted to a set of individuals.  This is controlled using the same security privileges identified above, but allows businesses to create their own custom privileges, then restrict actions to those users who have such privileges.

Here are some of the most common action-level security restrictions a business might use:

• Restrict export capabilities
• Restrict permanent deletion of data
• Restrict access to reports
• Restrict creation of records in certain apps
• Restrict the ability to perform bulk data changes

Field-Level Security

While data-level access controls which record a user might be able to view/edit, they still might not have complete access to every field on that record.  Apptivo allows administrators to restrict every field individually using security privileges.  An administrator can choose which privilege is required to view a field, edit a field, or submit a value for a field during creation only.

Search Security

Action-level security can completely remove the ability for a user to run a search, but some companies might have specific limitations required to control the risk of their data being harvested by a malicious employee.  Each field can individually be controlled, and an administrator will choose which types of users are allowed to run a search using that field.

Complete Audit History

Apptivo stores two types of audit logs: System Logs, and News Feed.  The system logs are internal logs for details such as when/where an account logged in, and what actions they performed.  These logs are only accessible to specially credentialed Apptivo system administration staff for monitoring and investigation of issues.  These system logs are maintained for 30 days before deletion.

The news feed feature is the complete audit history available to clients.  Every change to data within the system is automatically captured within the news feed.  This will capture the user who performed the action, the time, and the old/new values if something was changed.  All field changes, the creation of records, updates to records, deletion of records, or any other activity is captured and visible to Apptivo administrators.  This audit history can be filtered down to a specific rep or record within the platform on demand.