Question 1

Is Engaging Networks SOC 2 compliant?

Accepted Answer

Engaging Networks is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Engaging Networks HIPAA compliant?

Accepted Answer

According to Engaging Networks's public trust center, Engaging Networks is HIPAA compliant. On SOC2C this listing is Listed.

Question 3

Is Engaging Networks GDPR compliant?

Accepted Answer

According to Engaging Networks's public trust center, Engaging Networks is GDPR compliant. On SOC2C this listing is Listed.

Question 4

Is Engaging Networks PCI DSS compliant?

Accepted Answer

According to Engaging Networks's public trust center, Engaging Networks is PCI DSS compliant. On SOC2C this listing is Listed.

Question 5

Is Engaging Networks SOC 2 Type I or Type II?

Accepted Answer

Engaging Networks is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 6

Can I use Engaging Networks's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Engaging Networks's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 7

Is Engaging Networks penetration tested?

Accepted Answer

Engaging Networks hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 8

Is Engaging Networks secure?

Accepted Answer

Security isn't a single yes/no, but Engaging Networks is SOC 2 Type II compliant and holds HIPAA, SOC 2 Type II, GDPR, PCI DSS. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 9

Does Engaging Networks have a bug bounty or vulnerability disclosure program?

Accepted Answer

Engaging Networks hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@engagingnetworks.net or via a /security page (Engaging Networks lists a security contact).

Question 10

Who are Engaging Networks's subprocessors?

Accepted Answer

Engaging Networks lists 9 subprocessors on its trust center, including Amazon Web Services, Cloudflare, eSolution, Egnyte, Engaging Networks software support services. Buyers use this for fourth-party risk review.

Question 11

Where does Engaging Networks host or store data?

Accepted Answer

Engaging Networks hosts on AWS. Data residency details are on its trust center.

Question 12

Where is Engaging Networks's trust center or security page?

Accepted Answer

Engaging Networks's trust center is at https://trust.engagingnetworks.net. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 13

Do you support encryption in transit and at rest?

Accepted Answer

Yes, all data entering and exiting the EN platform is encrypted from the endpoint to our Internet proxy/load balancer using SSL. From there all traffic passes through a web application firewall and is then re-encrypted using SSL until it hits our web servers. We use TLS 1.2 for data in transit and have deprecated several ciphers available in TLS 1.2. For data at rest, we use Amazon EBS encryption, which uses AES-256.

Question 14

Is the platform GDPR compliant?

Accepted Answer

Some of our clients may need to comply with the General Data Protection Regulation promulgated under EU 2016/679 if they acquire Personal Data from residents of the European Union. In those cases, Engaging Networks is a processor in the provision of the Services set forth under our standard Agreement. Clients are solely responsible for ascertaining whether they must comply with GDPR. While Engaging Networks provides GDPR compliant services, Clients shall only be in compliance with the GDPR if they have executed a Data Processing Agreement (DPA).

Question 15

Where is EU or UK data processed?

Accepted Answer

When the cross-border transfer of data does occur, the personal data may be accessed from the USA but remains on our servers in Canada – and Canada has an adequacy decision with the UK / EU which recognizes that they provide an equivalent level of protection for personal data as the EU / UK does. Our aim is to be as transparent as possible when it comes to data protection and our role as a data processor for your Engaging Networks accounts. With this in mind, we have developed the following: - Data Processing Agreement (DPA) - International Data Transfer Agreement (IDTA) between Engaging Networks and Engaging Networks USA - A signed 'Linked Agreement' between the two parties - Transfer Impact Assessment Refer to this link for more detailed information on Engaging Networks' Data Protection Agreements: https://knowledge.engagingnetworks.net/softwaresecurityandprivacy/detailed-information-on-engaging-networks-data-pro

Question 16

How does Engaging Networks help protect clients from fraudulent activity on donation forms?

Accepted Answer

One of the most popular anti-fraud measures that our clients implement on their web pages is a reCAPTCHA challenge, which is easily applied to any form when building the page and can be restricted to only appear for high risk countries. Engaging Networks also automatically blocks IP addresses that submit multiple rejected transactions in a period of time. Engaging Networks uses Cloudflare as one of our Web Application firewalls (WAF). This provides a significant detection, and mitigation capability to all hosted Engaging Networks content. We use Cloudflare managed rulesets as well as our own custom rulesets to mitigate malicious activity. More information can be found: https://developers.cloudflare.com/waf/ We have also implemented Cloudflare Bot Management. This capability allows us to identify bad bots and challenge (or block) them from accessing any hosted content while not impacting legitimate user access to sites. More information on this can be found: https://www.cloudflare.com/application-services/products/bot-management/ Additional fraud prevent measures include: Email/SMS fraud notification alerts: If a donation page repeatedly generates rejected transactions, it may indicate that someone is trying to abuse the page. When such activity is suspected, the software will notify clients via email and/or SMS, and suggest steps to improve the situation. Allowed domains: Pages will load only on a client’s custom subdomain, reducing attacks from spammers who take advantage of sequential pages on default domains. Spam traps: Ability to add a hidden field that can prevent page submissions by spambots but will be invisible to human supporters.

Question 17

What is the backup policy?

Accepted Answer

Engaging Networks will provide data backups sufficient to enable recovery of all clients’ data in response to a system-wide event that affects the entire software platform, but not to recover the data of an individual client that deletes or damages the data that they store in their Engaging Networks software account. Therefore Client is responsible for making their own backup copy (e.g. in a separate CRM database of record, such as Salesforce) of the constituent data and transaction data that Client stores in their Engaging Networks account.

Question 18

What is PCI DSS?

Accepted Answer

Payment Card Industry Data Security Standard (PCI DSS) defines security requirements to protect environments where payment account data is stored, processed, or transmitted. PCI DSS provides a baseline of technical and operational requirements designed to protect payment account data. Reference: https://www.pcisecuritystandards.org/standards/pci-dss/

Question 19

Who has to adhere to PCI DSS?

Accepted Answer

If you are running donation pages on Engaging Networks, then PCI DSS applies to you and your pages must be scanned by an ASV. If your pages are non-compliant, then you must fix them or Engaging Networks will shut them down.

Question 20

What are the technical details behind an ASV scan?

Accepted Answer

An ASV scan is an external vulnerability scan performed by an Approved Scanning Vendor (ASV). Merchants and Third Party Service Providers (TPSP) have a requirement to perform ASV scans, especially where there is shared responsibility for the creation and hosting of payment webpages. ASV scans apply to Internet-facing systems (like webservers) that host webpages that either 1) redirect payment transactions to a PCI DSS compliant TPSP or 2) include an embedded payment page/form (iframe) from a PCI DSS compliant TPSP. The intent is for merchants to minimize the risk of compromise by scanning for and resolving identified vulnerabilities that could potentially expose their link to the TPSP's payment page. These scans must be run quarterly.

Question 21

Donation Pages - What is the PCI Requirement?

Accepted Answer

If you run donation pages on Engaging Networks, your pages must be scanned by an ASV and if your pages are non-compliant, then you must fix them or Engaging Networks will shut them down.

Question 22

Is the Engaging Networks' platform compliant with the HIPAA Security rule?

Accepted Answer

Yes, we have validated our compliance to the HIPAA Security rule via an internal HIPAA security assessment. Note this assessment does a crosswalk against the platform security controls that have already been validated by an external PCI DSS auditor and a SOC2 Type 2 auditor. Staff and contractors receive HIPAA security awareness training and HIPAA policies. Additionally, we have added an external HIPAA risk assessment to our compliance roadmap for this year.

Question 23

What data is being used in AI Segments?

Accepted Answer

The AI Segments offering is a separate opt-in service which requires a separate contract (that involves Engaging Networks and our sister company Accessible Intelligence). The data that is used is Transactional data and emails. Transaction data is sent to Accessible Intelligence and each row of transaction data is only identified through an encrypted / hashed Oracle ID. There is absolutely zero constituent data sent over to Accessible Intelligence. The only other data sent to Accessible Intelligence is the client's email content (which is in the public domain regardless. The email content is classified and then used in the client model. Identity Data includes a hashed Oracle ID received from Engaging Networks Limited. Transaction Data includes details about donations/purchases, but the vast majority is other interactions such as email clicks or activist actions. Profile Data includes preferences for various marketing content.

Question 24

What happens to the output data from AI Segments?

Accepted Answer

The output data is a new set of segments that appear in the EN segments tool (which we push back via API). These can be used by the client to target their marketing to new groups that have been identified by the AI model. For example "A segment of your supporters that respond well to emails written with a positive emotion".

Engaging Networks

About

Compliance & infrastructure

Documents

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Technology peers that completed SOC 2

Action1

ELJUN LLC

equipifi

IntelligentSystems Corp