IBTx.ai Security and Risk Focus
Layered controls to safeguard customer data.
1. Security and Compliance Objectives
Our security framework is built on SaaS industry best practices. Its main goals are:
- Customer Trust and Protection: provide excellent products and services while keeping data private and confidential
- Availability and Continuity of Service: keep the service available and reduce the risk of interruptions
- Information and Service Integrity: ensure customer information is never improperly corrupted or
changed. - Compliance with Standards: work to meet or surpass recognized industry best practices.
Security at a Glance
|
Hosting
Google Cloud Platform and AWS, United States |
Encryption in transit
TLS 1.2 or 1.3, 2,048-bit keys or stronger |
|
Encryption at rest
AES-256 |
Backups
Daily, with seven days kept for each database |
|
Configuration drift
Baseline restored within 30 minutes |
Employee portal access
Just-in-time, logged, 24-hour maximum |
|
Login protection
Two-factor authentication; admins can require it for all users |
Deleted records
Restorable for up to 30 days from the recycle bin, where available |
IBTx.ai Security Controls
To protect the data entrusted to us, IBTx.ai applies layered administrative, technical, and physical safeguards across the organization. The sections that follow cover a selection of the questions we are asked most often about these controls.
2. Infrastructure Security
Cloud Hosting Provider
IBTx.ai keeps no product systems or data in its own physical offices. Hosting of the product infrastructure is outsourced to major cloud providers, including Google Cloud Platform Services and Amazon Web Services, and it is located in the United States. For the effectiveness of physical, environmental, and infrastructure security, we rely on the audited security and compliance programs of Google and AWS.
Google publishes service-specific Service Level Agreements (SLAs) with monthly uptime commitments for its cloud services. More detail on Google’s controls, processes, and compliance measures is available in its public Compliance Resource Center.
AWS publishes service-specific SLAs with monthly uptime commitments and provides redundancy for all power, network, and HVAC services. Its business continuity and disaster recovery plans for AWS services have been independently validated through its SOC 2 Type 2 report and ISO 27001 certification. AWS’s compliance documentation and audit reports can be found publicly on the AWS Cloud Compliance Page and the AWS Artifact portal.
Network and Perimeter
Every connection to the IBTx.ai product infrastructure passes through several layers of filtering and inspection, spanning the web application, logical firewalls, and security groups. Network access control lists keep unauthorized parties away from internal product infrastructure and resources. Firewalls deny any connection that has not been explicitly permitted. Changes to network and perimeter systems follow standard change control processes, and firewall rulesets are reviewed periodically so that only necessary connections remain configured.
Configuration Management
Automation allows IBTx.ai to scale with customer demand, and strict configuration management is part of everyday infrastructure operations. The product infrastructure is highly automated and adds capacity whenneeded. Server configurations are stored in images and configuration files that are used whenever new containers are provisioned. Every container has its own hardened configuration, and changes to configurations and standard images go through a controlled change pipeline.
Server instances are closely controlled throughout their lifecycle, from provisioning to deprovisioning, so deviations from configuration baselines are detected and corrected on a predefined schedule. If a production server departs from its baseline configuration, the baseline is restored over it within 30 minutes. Patching is performed with automated configuration management tools, or by removing server instances that no longer match the expected baseline.
Logging
Actions and events inside the IBTx.ai application are logged consistently and in detail. Logs are indexed and kept in a central logging system within IBTx.ai’s cloud environment, and security-relevant logs are likewise retained and indexed to support investigation and response. How long logs are kept depends on the type of data involved. Write access to the log storage service is tightly controlled and restricted to the small group of engineers who need it.
Alerting and Monitoring
IBTx.ai invests in automated monitoring, alerting, and response so that potential issues are handled continuously.
The product infrastructure is instrumented to notify engineers and administrators of anomalies. Elevated error rates, abuse scenarios, application attacks, and other anomalies set off automatic responses or alerts to the right teams for response, investigation, and correction. Many automated triggers are also built to react to anomalies immediately; for instance, traffic throttling and process termination activate at predefined thresholds.
3. Application Security
Web Application Defenses
Firewall and application security protect all customer content hosted on the platform. Monitoring tools watch the application layer and can raise alerts on malicious behavior according to behavior type and session rate. The rules for detecting and blocking malicious traffic follow the best practice guidance of the Open Web Application Security Project (OWASP), particularly the OWASP Top 10 and comparable recommendations. Protection against Distributed Denial of Service (DDoS) attacks is also built in, which helps keep customers’ websites and the other parts of the IBTx.ai products continuously available.
Development and Release Management
IBTx.ai improves its products through a modern continuous delivery approach to development, and new code is deployed frequently. Before deployment, code is reviewed, tested, and approved for merge. Static code analysis runs regularly on code repositories and stops known misconfigurations from entering the code base. Designated repository owners control approval, after which code is automatically sent to IBTx.ai’s continuous integration environment for compilation, packaging, and unit testing.
Dynamic security testing of the applications is performed periodically. New code first goes to a separate, dedicated QA environment for final testing before it is promoted to production, and network-level and projectlevel segmentation prevents unauthorized access between QA and production. All deployments are automated and can be reverted if they fail. The deploying team handles notifications about application health, and rollback begins immediately when a failure occurs. Extensive software gating and traffic management let us control feature availability according to customer preferences (private beta, public beta, full launch).
Updates are seamless, and because IBTx.ai is a SaaS application, releases involve no downtime. Significant feature changes are announced through in-app messages and/or product update posts.
Vulnerability Management
IBTx.ai’s team uses a multi-layered approach to vulnerability management, drawing on a range of industryrecognized tools and threat feeds to cover the whole technology stack. Vulnerability scans run regularly, using adaptive inclusion lists for asset discovery along with the newest detection signatures. Penetration tests of
applications and infrastructure are carried out every year to uncover vulnerabilities that could pose security risks. Relevant findings are assessed, and fixes are prioritized accordingly.
4. Customer Data Protection
Data Classification
Under the IBTx.ai Terms of Service, customers are responsible for capturing only information that is appropriate for supporting their marketing, sales, service, content management, and operations processes. IBTx.ai products should not be used to collect or store sensitive information such as credit or debit card numbers, financial account information, Social Security numbers, passport numbers, or financial or health information, unless otherwise permitted. Health information, including electronic Protected Health Information (ePHI), may only be stored on accounts with the HIPAA Compliance package activated and a signed Business Associate Agreement (BAA).
Tenant Separation
IBTx.ai is a multi-tenant SaaS solution in which customer data is separated logically, with unique IDs linking data and objects to individual customers. Authorization rules are part of the architecture and are validated continuously. We also log application authentication and related changes, application availability, and user access and changes.
Encryption
All data in transit is encrypted using TLS version 1.2 or 1.3 with keys of 2,048 bits or stronger. TLS is also enabled by default for customers who host their websites on the IBTx.ai platform.
Several technologies are used to encrypt stored data at rest. Platform data is stored with AES-256 encryption, and user passwords are hashed according to industry best practices and encrypted at rest.
Key Management
The IBTx.ai platform securely manages the encryption keys for both in-transit and at-rest encryption. TLS private keys for in-transit encryption are handled through our content delivery partner, while volume-level and fieldlevel keys for at-rest encryption are held in a hardened Key Management System (KMS). Keys are rotated at different frequencies depending on how sensitive the data they protect is, and TLS certificates are generally renewed each year. IBTx.ai cannot currently use encryption keys supplied by customers.
5. Data Backup and Disaster Recovery
System Reliability and Recovery
IBTx.ai is committed to keeping system downtime to a minimum, and all product services are designed with redundancy. Server infrastructure is spread across multiple separate availability zones and virtual private cloud networks at our infrastructure providers, and every web, application, and database component is deployed with point-in-time recovery.
Backup Strategy
System Backups
Systems are backed up regularly according to set schedules and frequencies. Seven days of backups are retained for every database, in a way that makes restoration straightforward.
Backup runs are monitored for success, with alerts raised on any exception; failure alerts are escalated, investigated, and resolved. Data is backed up daily to the local region, and replication failures are monitored, alerted on, and triaged accordingly.
Physical Backup Storage
Since hosting, backup, and recovery rely on public cloud services, IBTx.ai operates no physical infrastructure or storage media for its products. IBTx.ai also does not generally create or use other hard-copy media, such as paper or tape, in delivering its products to customers.
Backup Protections
By default, backups are protected by access control restrictions and write once read many (WORM) protections on IBTx.ai product infrastructure networks, together with access control lists on the file systems that store the backup files.
Customer Data Backup Restoration
Customers cannot access the product infrastructure in a way that would let them trigger a failover themselves;
IBTx.ai’s product engineering teams manage disaster recovery and resiliency operations. In some cases, customers can restore deleted contacts, opportunities, custom fields, custom values, tags, notes, and tasks directly from the recycle bin for up to 30 days after deletion. Earlier versions of web pages, blog posts, and emails can be recovered through version history. Customers who want their own additional backups have many options on the IBTx.ai platform for making sure they hold the data they need.
Many features in the IBTx.ai portal offer export options, and IBTx.ai’s library of public APIs can be used to synchronize data with other systems.
6. Identity and Access Control
Product User Management
IBTx.ai products support granular authorization rules. Customers can create and manage the users in their own portals, grant the privileges that suit each one, and restrict access as they choose.
Product Login Protections
Users can sign in to their IBTx.ai accounts with the native IBTx.ai login, which enforces one standard password policy: at least 8 characters, combining lowercase and uppercase letters, special characters, and numbers. Those who use the native login cannot change this default policy. Customers using IBTx.ai’s built-in login can protect their accounts with two-factor authentication, and portal administrators can require every user to enable it.
7. IBTx.ai Employee Access to Customer Data
Access to Production Infrastructure
Access to internal data stores and production infrastructure is tightly controlled. Employees receive access through a role-based access control (RBAC) model; routine access is limited to members of the Engineering team, and standing administrative access is restricted. Direct network connections to product infrastructure devices over SSH or similar protocols are prohibited. Engineers must first authenticate through a bastion host or “jump box,” or hold an assigned IAM role on the resource, before they can reach server environments.
Access to Customer Portals
By default, Customer Support, Services, and other customer-facing staff can get limited access to parts of your IBTx.ai account in order to help you use it. The application also uses a JITA model to give employees temporary access to a customer’s portal (Portal JITA). Every Portal JITA request is logged, and access is limited to one specific customer’s portal for at most 24 hours. IBTx.ai additionally applies risk-based monitoring to spot unusual Portal JITA activity.
While using Portal JITA to access a portal, IBTx.ai employees cannot carry out high-risk actions such as:
● Changing domain or SSO settings
● Exporting users/contacts
● Viewing/creating/deleting/rotating private app keys
● Importing data to the CRM
● Deleting contacts, companies, deals, and tickets
Logging covers user logins, IBTx.ai employee access, security activity, and content activity.
Corporate Authentication and Authorization
Reaching the IBTx.ai company network requires MFA. Password policies reflect industry best practices for length, complexity, and rotation frequency. Password vaults manage certain administrative account passwords, and access to the vault is governed by Role Based Access Control or the JITA process. We have built a comprehensive support system that streamlines and automates our security management and compliance work.
Among its many functions, it helps ensure that permission grants are appropriate, employee events are handled, access is revoked promptly, change logs are collected effectively, and compliance evidence is preserved. Access and permissions for key internal systems are reviewed manually every six months to confirm that the access granted is needed for each person’s job.
8. Organizational and Corporate Security
Background Checks and Onboarding
Employees pass a third-party background check before a formal employment offer is made, and reference verification is carried out at the hiring manager’s discretion. On joining, every employee must read and acknowledge IBTx.ai’s Employee Handbook and Code of Conduct, which set out their security responsibilities for protecting company assets and data.
Policy Management
To keep everyone aligned on protecting data, IBTx.ai writes down and maintains its policies and procedures. In
particular, it keeps a core Written Information Security Policy covering topics such as data handling
requirements, privacy considerations, and disciplinary action for policy violations. Policies are reviewed and
approved at least once a year.
Security Awareness Training
Employees must complete CyberSafety training when they start, and it is offered again every year afterward. The training also covers phishing awareness.
Vendor Management
IBTx.ai may use third-party service providers to help develop its product and support internal operations. Contracts with vendors are used to make sure they maintain suitable security and privacy controls. A list of our sub-processors, which may change from time to time, is kept in our Data Processing Agreement.
Endpoint Protection
Company-issued laptops are managed centrally and configured with full disk encryption. A Mobile Device Management solution gives IT administrators a central platform to manage and monitor mobile devices across the organization, including configuring device settings, enforcing security policies, deploying apps, and checking compliance with corporate policies.
9. Compliance
Sensitive Data Processing and Storing
See our Terms of Service and Privacy Policy for more on how and why we process data. IBTx.ai’s payment services have been validated against PCI DSS v4.0.1 by an independent Qualified Security Assessor (QSA) as a service provider. Our system architecture is designed not to store cardholder data, and payment transactions are handled by the PCI-compliant payment card processors that we use.
IBTx.ai has also completed a SOC 2 Type II examination covering Security, Confidentiality, and Availability, and offers an optional HIPAA Compliance package, including a Business Associate Agreement (BAA), for customers who handle ePHI.
Privacy
As our Privacy Policy explains, we do not sell your personal data to third parties. The protections in this document, along with others we have put in place, are meant to keep your data private and unaltered.
Data Retention and Data Deletion
Customer data is kept for as long as you remain an active customer. Current and former customers may submit written requests to delete certain data, and IBTx.ai will carry them out as privacy rules and regulations require.
Some data, such as logs and related metadata, is retained to meet security, compliance, or statutory needs. IBTx.ai does not currently let customers set custom data retention policies.
Privacy Program Management
IBTx.ai’s Legal Team works with the engineering and product development teams to run an effective privacy program. Our Privacy Policy and Data Processing Agreement describe in more detail our commitment to protecting the privacy of your data.
Breach Response
If IBTx.ai learns of a data breach affecting your personal data, it will notify customers as the law requires.
GDPR
IBTx.ai aims to offer features that make it easy for customers to reach and maintain GDPR compliance; see our GDPR page for more information. IBTx.ai seeks to support your GDPR efforts, but using the product alone does not make you GDPR compliant.
10. Document Scope and Use
This document is meant as a resource for customers. It does not create any binding or contractual obligation between IBTx.ai and any party, and it does not amend, alter, or revise any existing agreement between the parties. Because IBTx.ai keeps improving its protections, its procedures may change.
