Lingoapp

Security isn't a single yes/no, but Lingoapp is SOC 2 Type II compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Lingoapp hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@lingoapp.com or via a /security page (Lingoapp lists a security contact).

Lingoapp lists 6 subprocessors on its trust center, including Amazon Web Services, Stripe, Sentry, CloudConvert, HubSpot. Buyers use this for fourth-party risk review.

Lingoapp hosts on AWS. Data residency details are on its trust center.

Lingoapp's trust center is at https://trust-report.lingoapp.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

We're really happy you use Lingo, we are, but we don't want to know a lot about you. Your personal and business information is yours and we want to keep it that way. We always aim to only collect the bare minimum information we need in order to make Lingo better for you. For the personal information you and your users do make available via the Lingo service as defined in our privacy policy, we have strict controls over employee access and only access it when necessary, typically for the purposes of diagnosing and resolving a problem you may experience with Lingo. We also never use customer data in test environments without prior consent, again, typically only for the purposes of solving a problem.

Lingo insights provide realtime data on how people are accessing and using your content and the Lingo service. As of February 2021, Lingo does keep detailed logs of all changes made to the members and content of spaces. Such data can be made available to paid spaces upon request. We look forward to expanding the Insights features to include more change log and auditing capabilities directly in the lingo app. If you are interested in this functionality, please contact us.

Lingo offers a few options for authenticating and accessing your teams data. ## Single Sign On Lingo provides Single Sign-On (SSO) functionality for enterprise customers to gain access to Lingo Spaces through a single authentication source, like Okta. This allows Space administrators to better manage user access, makes it very easy for new hires to join your Space, and keeps your assets more secure. We use SAML (Security Assertion Markup Language), a standard that permits identity providers like Okta to safely pass authorization information to service providers like Lingo. Lingo also supports SCIM (System for Cross-domain Identity Management) for automatic provisioning of user accounts. Learn more about setting up SSO for your space ## Passwords Any account can be configured with password authentication. By default SSO accounts are created without a password but one can be added after completing the SSO signup process through your provider. Kits and spaces can also be configured with password protected access for securely sharing your content with people that do not have Lingo accounts. * All passwords are hashed using PBKDF2 * All user account sessions are invalidated anytime the account password changes * All access granted with a kit or space password is invalidated when the password changes * Accessing a kit or space with a password is only valid for 2 weeks after which the password will need to be provided again. * Password requirements * We enforce a minimum 8 character password length * Authentication endpoints are rate limited to prevent brute force attacks. Unusual traffic to these APIs will alert our team to invest age further. ## Two factor authentication MFA can be enabled for any user account. You must use an authenticator app such as Google Authenticator, Microsoft Authenticator, or Authy. Once enabled, recovery codes are also provided as a backup method if the configuration is lost. #### Can I require MFA for my organization At this time, MFA is…

In Lingo, customer data is protected by layers of authentication and per-user permissions. There are several checks, on every request, to ensure that the authenticated user is only being served data belonging to workspaces they are authorized to access. When a user requests data, be it a file download or file metadata, the user must be authenticated using the methods described in Authentication above. Once the user is authorized, every request checks that the user has active access to the workspace the data belongs to, checks that the user has active access to the "kit" that the data belongs to, and checks that the user has access to the "version" of the "kit" that the data belongs to. There is no way to access data in Lingo that bypasses these checks. You can learn more about the available roles and how to manage users in our Help Center ### Storage and Encryption All account and content metadata is stored in our main database service which is encrypted at rest. We preform daily backups of our main database which includes all account data and content metadata. Backup's are retained for 7 days. ### File Storage All asset files are are stored and encrypted (AES-256) on AWS s3 which boasts 99.999999999% durability and is designed to sustain concurrent loss of data in multiple facilities by spreading files across multiple availability zones. You can read more about that here. All original files are private and must be accessed via an authenticated request to the Lingo API. Some thumbnails are publicly available but are obfuscated by an unguessable url. These public files are only made available to power public content sharing features offered in Lingo. > Note: by default individual assets share links allow anyone with the link to view that asset. If you require additional security, contact us to learn more. ### Availability Lingo’s primary hosting is in eastern US but is accessible worldwide. Some of our services are deployed in multiple facilities to ensure optimum…

### Incident Management & Response We deploy best in class monitoring tools to ensure we are made aware of any issues happening in the Lingo service. As soon as a problem is detected our technical team begins diagnosing the issue as soon as possible. ### Outages and disruptions We typically have major issues fixed within a few hours assuming the issue is within our control. We are ultimately reliant on our trusted hosting provider. In the event of an outage or problem you can reach out to use via email at info@lingoapp.com to inquire more information if you have not already been made aware of the problem via other channels such as twitter. ### Data Breaches Should lingo ever be the target of a data breach, we will let all affected customers know as soon as possible to ensure you can take precautions to mitigate further breaches. ### Disaster Recovery Customer Data is stored redundantly at multiple locations in our hosting provider’s data centers to ensure availability. We have well-tested backup and restoration procedures, which allow recovery from a major disaster. Customer Data and our source code are automatically backed up nightly.

Account data can be downloaded from the account \privacy page.\. If you need to export all of your space data, please \contact us\ If you need to export all of your account data including space data such as asset files and metadata, please contact us.

Data added to your account or spaces is retained indefinitely. Deleted assets remain available within kits and can be restored for up to 30 days. After 30 days, content can still be restored upon request for at least 30 days. You can read more about deleting and restoring assets in this \help center article\. If you wish to have data permanently deleted from Lingo, we can do so upon request. \*All system backups are retained for 7 days\*