Security in Agillic
Introduction
Agillic is a marketing automation platform with a focus on personalised multi-channel communication where contact and communication relevant data are processed. Agillic follows a service (and micro-service) architecture making the system robust and scalable. To ensure cost-efficient performance, Agillic uses several hosting providers.
The General Data Protection Regulation (GDPR) about the protection of physical persons in connection with the handling of personal data and exchange of these (EU 2016/679) describes several rules on how to handle personal data.
The handling and control of the rules are part of Agillics Information Security Management System (ISMS) and based on the relevant ISO 27001/2 controls and requirements related to the Data Processing Agreement (DPA) between Agillic and our customers. Agillics ISMS is audited yearly following the ISAE 3000 standard. All our subcontractors and potential services are evaluated according to the policies given by our ISMS.
This document is a supplement to the ISAE 3000 assurance report and focuses on Agillic’s security architecture. It consists of five elements as pictured below:
The fifth element, Policies and controls, is the part of ISMS that focuses on security. Each of the five elements is described below.
1. Application Security
The Application Security ensures authentication and authorisation access to the Agillic platform.
Authentication
User access requires authentication using a valid username and a strong password defined by your password policy. We also support Two-factor Authentication using SMS or e-mail. The application runs on a secure HTTPS channel.
Authorisation
The Agillic platform provides role-based access with policies restricting and limiting users right to sensitive customer data and with the possibility to give granular permission to various parts of the application. Our APIs have full access to data.
If authorised as Administrator, it is possible to create integration with Facebook, Google Ads and Adform using each providers standard integration method.
User Logging
All application activities (incl. user interactions and API calls) are automatically logged with a timestamp. The log is used internally in Agillic for investigations and product improvements
2. Data Security
The Data Security regulates data, storage and transmission.
Database security
Access restrictions
All customer data are stored at our data centre partners, all of which are severely restricted so that only personnel with the correct authorisation can access them. To ensure the highest levels of security, Agillic operates the virtual servers and are responsible for provisioning, monitoring, and managing them.
Encryption
All customer data and log data are encrypted using 256-bit AES encryption and an account-specific key. All sensitive profile data that is masked on storage as well as on display to maintain confidentiality.
Transmission
Agillic provides encryption for data in transit on all public channels (SFTP, HTTPS API and user interface, WebDAV over HTTPS). Agillic currently supports TLS 1.0, TLS 1.1, TLS 1.2 and TLS 1.3.
Data in transit between different Agillic components is encrypted using TLS 1.2 over HTTPS.
Tracking and data collection
Agillic is collecting email response on an individual level (open status, click on links, rebound, etc.).
Furthermore, Agillic provides a website tracking script (use is not mandatory). The platform assigns a 1st party cookie ID to an internal system ID when a consumer is engaging (i.e. clicking on a link) and make it possible to track known consumers’ behaviour on your web site.
Agillic also provides an advanced tracking script, utilises Google Tag Manager, for more granular monitoring of consumer activity and behaviour on your website. This data is currently only used in our AI offering.
The collected tracking data can on the platform only be used in defining a target group for a specific communication purpose.
Deletion of recipients
Agillic is build to integrate with master data repositories that control addition and removal of recipients. The recommended approach to maintain recipient data is through data integration. It is however also possible to delete recipients manually in Agillic using target groups.
3. System Security
The System Security address the protection of the software modules, resources and configurations powering the Agillic platform.
Activity Logging
Activities across different system components are logged and tracked for auditing purposes. The activity is logged with date/time, type of activity, source IP, and other relevant transactional information.
Availability, Backups, Redundancy, and Recovery
The Agillic platform is built on a high-availability infrastructure, backed by a proven industry vendor. In case of hardware failure, our virtualised servers are automatically transferred to new hardware with no downtime.
Backups are done daily and are stored for two months off-premise at multiple sites. To stay compliant with the “right-to-be-forgotten”, an internal recipient ID is stored and used to re-delete deleted customers after a restore.
Geo-fencing
We ensure the storage of customer data within the EU (either in Denmark or Ireland).
4. Infrastructure Security
The Infrastructure Security addresses the protection of the physical services and data devices, enabling the platform.
Virtual Security
The setup of our infrastructure is as restricted as possible. That includes whom that can access the servers, firewall configuration, IP restrictions, disabling of non-used features (hardening) and use as secure cyphers as possible.
Network Management
The implemented firewall only allows Internet connection to the allowed ports: Port 80 for HTTP and Port 443 for HTTPS. The firewall also handles Network Address Translation (NAT). NAT masks the true IP address of a server from the client connecting to it.
Broadcast storm mitigation services are used to protect our servers from DDoS and similar attacks.
Maintenance and monitoring
We patch and upgrade applications and servers regularly to ensure the best possible protection from exploits. Furthermore, Agillic performs regular vulnerability assessments of our networks and equipment using a variety of tools and technologies, including Nessus and other industry-standard solutions.
Physical security
Customer data and our production environments are all hosted at high-security, Tier3+ equivalent data centres that conform to ISO 27001 Information Security Standards. They are located in either Denmark or Ireland.
Access Control
Access to the data centres where the application is running and the data is persisting is limited to authorised personnel only. Physical security measures include on-premises security guards, closed-circuit video monitoring and additional intrusion protection measures.
5. Policies and Controls
Employees
Access to customer data
Agillic employees are restricted to access customer data on a need-to-know basis, based on the role of the employee and only after written consent by the customer. All such access is logged in details.
Training
Agillic employees are trained on how to apply security and privacy policy when hired and regularly.
Work Stations
The personal computer for each employee is centrally managed and updated (incl. antivirus, patches and enforcement of automatic access lock).
The networks are segregated to ensure least privileged access and access are centralised managed (LDAP).
Development
Security is an integrated part of Agillics development process with a focus on Security-by-Design as well as Privacy-by-Design.
Dedicated personal
Agillic has dedicated IT security personnel that continuously monitor status and improve the security setup by taking proactive as well as corrective actions.
Incident and Risk Handling
The handling of incidents and identified risks follows a strict and well-defined procedure.
Change Procedure
Our management of changes incl. a risk assessment, QA and approval processes are described in our ISMS.
