Data Security

Information Security Policy

as of 04/14/2016

Security Statement 

Hundreds of thousands of users have entrusted AgentMarketing.com with their personal and customer data, and we make it a priority to take our users’ security and privacy concerns seriously. We strive to ensure that user data is kept securely, and that we collect only as much personal data as is required to provide our services to users in an efficient and effective manner. 

AgentMarketing.com uses some of the most advanced cloud based technologies for Internet security that is commercially available today. This Security Statement is aimed at being transparent about our security infrastructure and practices, to help reassure you that your data is appropriately protected. 

Application and User Security

  • SSL/TLS Encryption: All credit card data is passed over secured, encrypted SSL/TLS connections. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) technology (the successor technology to SSL) protect communications by using both server authentication and data encryption. This ensures that user data in transit is safe, secure, and available only to intended recipients.
  • User Authentication: User data on our database is logically segregated by account-based access rules. User accounts have unique usernames and passwords that must be entered each time a user logs on. AgentMarketing.com issues a session cookie only to record encrypted authentication information for the duration of a specific session. The session cookie does not include the password of the user.
  • User Passwords: User application passwords have minimum complexity requirements. Passwords are individually salted and store encrypted.
  • Data Encryption: Certain sensitive user data, such as credit card details and account passwords, is stored in encrypted format.
  • Data Portability: AgentMarketing.com enables you to export some of your data from our system in a variety of formats so that you can back it up, or use it with other applications.
  • Privacy: We have a comprehensive privacy policy that provides a very transparent view of how we handle your data, including how we use your data, who we share it with, and how long we retain it.

Physical Security

  • Data Centers: Our information systems infrastructure (servers, networking equipment, etc.) is collocated at RackSpace cloud server centers located throughout the United States.
  • Data Center Security: RackSpace data centers are staffed and surveilled 24/7. Access is secured by security guards, visitors logs, and entry requirements such as passcards and biometric recognition.
  • Environmental Controls: RackSpace data centers are maintained at controlled temperatures and humidity ranges which are continuously monitored for variations. Smoke and fire detection and response systems are in place.
  • Location: All user data is stored on servers located in the United States.

Availability

  • Connectivity: Fully redundant IP network connections with multiple independent connections to a range of Tier 1 Internet access providers.
  • Power: Servers have redundant internal and external power supplies. Data center has backup power supplies, and is able to draw power from the multiple substations on the grid, several diesel generators, and backup batteries.
  • Uptime: Continuous uptime monitoring, with immediate escalation to AgentMarketing.com staff for any downtime.
  • Failover: Our database is log-shipped to standby servers and can failover in less than an hour.

Network Security

  • Uptime: Continuous uptime monitoring, with immediate escalation to AgentMarketing.com staff for any downtime.
  • Testing: System functionality and design changes are verified in an isolated test “sandbox” environment and subject to functional and security testing prior to deployment to active production systems.
  • Firewall: Firewall restricts access to all ports except 80 (http) and 443 (https).
  • Patching: Latest security patches are applied to all operating system and application files to mitigate newly discovered vulnerabilities.
  • Access Control: Secure VPN, multifactor authentication, and role-based access is enforced for systems management by authorized engineering staff.
  • Logging and Auditing: Central logging systems capture and archive all internal systems access including any failed authentication attempts.

Storage Security

  • Backup Frequency: Backups occur hourly internally, and daily to a centralized backup system for storage in multiple geographically disparate sites, stored for 7 days.
  • Production Redundancy: Data stored on a RAID 10 array. Duplicated on cloud storage devices.

Organizational & Administrative Security

  • Employee Screening: We perform background screening on all employees.
  • Training: We provide security and technology use training for employees.
  • Service Providers: We screen our service providers and bind them under contract to appropriate confidentiality obligations if they deal with any user data.
  • Access: Access controls to sensitive data in our databases, systems and environments are set on a need-to-know / least privilege necessary basis.
  • Audit Logging: We maintain and monitor audit logs on our services and systems (our logging systems generate gigabytes of log files each day and store for 30 days).
  • Information Security Policies: We maintain internal information security policies, including incident response plans, and regularly review and update them.

Software Development Practices

Stack: We code in php, jquery, javascript, MySQL database, a srict LAMP environment utilizing the bootstrap platform.Coding Practices: Our engineers use best practices and industry-standard secure coding guidelines to ensure secure coding.