Sendoso

Sendoso hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Sendoso publishes a DPA on its trust center; you can request access through SOC2C.

Security isn't a single yes/no, but Sendoso is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Sendoso hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@sendoso.com or via a /security page (Sendoso lists a security contact).

Sendoso lists 1 subprocessor on its trust center, including (Published Separately). Buyers use this for fourth-party risk review.

Sendoso's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Sendoso publishes a DPA on its trust center. You can request access through SOC2C.

Sendoso's trust center is at https://security.sendoso.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Personal information from customers and gift recipients Sendoso processes the minimal amount of personal information required for us to deliver the contracted service to our customer. \- The types of personal Information we process from our customers who are users of the Sendoso platform may include: full name, employer's name, email address, job title, information about their product account preferences, transactional system information (including billing address), and navigational information relevant to use of the Sendoso application including IP address. \- The types of personal information we process from our customer's targeted gift recipients may include: full name, email address, postal address, phone number, navigational information relevant to use of the Sendoso application including IP address, and any supporting information supplied to facilitate successful delivery of direct mail and goods through the service. Please review the Sendoso Privacy Policy at https://sendoso.com/privacy for more detail about data collected and its use in the Sendoso service. Credit Card information from Customer and Gift Recipients Sendoso does not collect, process, or retain credit card information. Customers who choose to make payments by credit card will be connected direct to our 3rd party credit card partner Stripe Inc. Gift recipients will never be asked to provide credit card information. Use of customer data Customer data (data directly supplied by the customer, or directly derived from customer-supplied data) remains the property of the customer throughout the life of the Sendoso service. We use customer data only in the delivery of service defined in contract. This may include our internal research to improve service or to define new service features. Retention schedule for customer data To support delivery of service and any potential follow-on activity that may be identified after individual sending requests are completed, customer data is held through the life…

Customer data encryption All customer data is encrypted at rest using the AES-256 standard, managed through the Key Management Service (KMS) of our hosting partner Amazon Web Services (AWS). All customer data is encrypted in transit using the TLS 1.2 standard. Cryptographic keys All cryptographic keys, including customer database keys, are managed centrally by the Engineering team using the AWS Key Management Service, 256-bit key length, and rotated annually. Network Data Loss Prevention (DLP) We maintain network-based data loss prevention (DLP) systems with a defined ruleset and automated monitoring to alert (or block, as appropriate) unauthorized traffic leaving the network or endpoints. Email filtering and blocks are in place using native Google Workspace capabilities. Endpoint device security Sendoso uses MalwareBytes ThreatDown EDR package on all company-managed workstations. This drives a daily antivirus/malware scan, based on antivirus signature profile that is updated daily. Full disk encryption is implemented on every company-managed device using ThreatLocker. An IRU security agent is installed on every company-managed device to enforce company security policies, and to enable company actions such as disable or wipe of the device in an emergency situation. Company personnel routinely use company-managed devices to access, inspect, and otherwise process customer information, including personal information of the client's customers for whom the client has initiated send requests, in certain normal business activities including system troubleshooting and root cause analysis of suspected security events. In normal business activities, company personnel are prohibited from storing customer information on company workstations or external to the solution environment without express agreement of the customer (which might arise in a customer-driven testing situation, for instance). Handheld/mobile device security Sendoso does not issue or manage personal mobile…

Controller / Processor / Sub-processor roles In customer's use of the Sending Management solution, Sendoso operates as a data processor and Sendoso's customer as the data controller. Sendoso suppliers who receive, store, or otherwise process a customer's personal data (or the personal data of the customers and gift recipients) are recognized as data sub-processors. Gift partners Sendoso gift partners are entities who offer and/or provide goods or services to customers through the Sending Management solution. Gift partners are not Sendoso suppliers or data sub-processors, but rather are third-party entities engaged in a direct relationship with the customer reviewing and/or consuming those goods and services. In this situation, Sendoso acts strictly as an intermediary providing a service platform to facilitate the connection between the customer and gift partner; in no circumstance is Sendoso acting as a reseller or a representative for the gift partner. In terms of privacy regulation, the customer and gift partner are responsible to establish their own agreement regarding controller and processor roles. In certain cases, the gift partner may receive a customer's personal information directly from Sendoso, as authorized by the customer in contract. Types of personal data processed as defined under GDPR Sendoso processes Personal Information for delivery of service. In no case does Sendoso collect or receive special categories of personal data as defined under GDPR. \- The types of personal Information we process from our customers who are users of the Sendoso platform may include: full name, employer's name, email address, job title, information about their product account preferences, transactional system information (including billing address), and navigational information relevant to use of the Sendoso application including IP address. \- The types of personal information we process from our customer's targeted gift recipients may include: full name, email…

Supplier approval The Supplier approval process includes review by the security team to evaluate the supplier's security profile and establish necessary security requirements. Suppliers who will require access to customer information are identified as data sub-processors. The current list of Sendoso data sub-processors is published at https://sendoso.com/data-sub-processor/ Customers will be notified by email when Sendoso makes periodic updates to this list. Data sub-processor contracts Security and data protection requirements for data sub-processors are maintained contractually, and consistent with requirements in Sendoso customer contracts. Where appropriate a DPA is included in the contract to detail these requirements. Where appropriate for cross-border transfer of data, GDPR standard contractual clauses as approved by EC on 04-Jun-2021 are included. Supplier Risk Management program Sendoso operates a Supplier Risk Management (SRM) program aligned to AICPA SOC 2 requirements. In this program, we periodically review the performance of suppliers to verify they maintain the relevant certifications \[SOC 1, SOC 2, ISO 27001:2013, PCI-DSS, etc.\] and specific security requirements of their contract with Sendoso. As part of the SRM program, every current data sub-processor is reviewed annually, as well as a selected group of other suppliers. Results of SRM program reviews are reflected in Sendoso's annual SOC2 Type II report.

Network protection and monitoring Sendoso applies many tools and process controls to ensure protection of the solution & customer data. These include: \- Configuration & Hardening: All network components are built using 'golden' images, based on configuration & hardening standards defined in the Sendoso Operations Security policy, which includes AWS Compliance Best Practices. \- IDS/IPS: network-based and host-based Intrusion Detection (IDS)/Intrusion Prevention (IPS) systems are used to detect anomalous and/or malicious traffic on our networks and systems. \- Firewall infrastructure: next-generation firewalls and/ or ACLs are utilized to restrict access to systems from external networks and between systems internally. By default, all access is denied and only explicitly allowed ports and protocols are permitted based on business need. Sendoso uses the AWS WAFv2 web application firewall. \- DDoS mitigation: the infrastructure incorporates multiple DDoS mitigation techniques in addition to maintaining multiple backbone connections. We work closely with our providers to quickly respond to events and enable advanced DDoS mitigation controls when needed. Log content & retention Sendoso collects comprehensive system and event records in system logs, and analyzes these logs continuously to ensure solution performance and security. Log data includes but is not limited to access, delete, change, event, and alert logs, as well as security events such as successful and failed authentication events, access control failures, deserialization failures, and input validation failures. Sendoso logs do not include any customer personal information. System logs are held in both Data Dog and AWS GuardDuty environments. All security-related system logs are retained for a minimum of 12 months. Event handling & response All system logs and monitoring data are forwarded to our Managed Security Services Provider (MSSP), who perform live 24x7x365 data correlation, alerting, and event…

Access controls for Sendoso company resources Access to corporate resources requires a corporate ID/password plus MFA. Corporate network user accounts are provided on a named-user basis, managed through the corporate Okta IAM platform. Sharing of passwords is prohibited by company policy as enforced by company training and the company disciplinary policy. All employees are provisioned OnePassword password vaults to ensure keys are kept confidential. Password complexity rules include 12-character PW length and special character requirements. User passwords for corporate resources must be reset after 90 days. On password reset, use of past 3 passwords is prohibited. 5 unsuccessful login attempts triggers a 15-minute user lockout period. Approving and implementing access changes Access privileges are controlled centrally by the Corporate IT function, and are assigned based on management-approved role-based access profiles to meet requirements of least privilege and separation of duties. Access change requests must be manager-approved to ensure these requirements are maintained, and then are implemented by the IT function. Privileged access controls Privileged access controls include all the standard access controls noted above, with addition of VPN. Sendoso uses Twingate VPN solution. Privileged access is limited to specific engineering and customer support roles. User Access Reviews (UARs) on company systems UARs are performed semi-annually for all key corporate resources, and annually for supporting resources, using the Vanta compliance platform. Access removal for departing personnel When an employee or contractor exits Sendoso, access removal is driven by HR and fully executed by IT within 24 hours. Customer Single Sign-On (SSO) to the Sending Management solution Sendoso supports SAML 2.0 or OIDC (OpenID Connect). Customers can manage their authentication and single-sign-on (SSO) options via Okta, OneLogin, Auth0, and other widely available service offerings. More…

Sendoso's secure SDLC process The Sendoso Sending solution is developed using a secure SDLC encompassing design, code review, testing, change management, and release management activities. \- Design: Specific security-by-design and privacy-by-design principles are defined, implemented and included in review processes. Developers undergo annual training in these secure development principles, and receive ongoing guidance and resources pertaining to coding best practices, such as prevention of common web application attacks and code vulnerabilities. \- Code Review: Manual/peer code review is done before deployment with 100% of the developed code is covered in the review process. \- Testing: We use Aikido Security for development stage vulnerability testing, with code scanned by developers at code repository check-in. Identified vulnerabilities are prioritized and remediated according to risk severity. Applications are reviewed and tested both pre- and post-deployment to ensure that there is no adverse impact on organizational operations or security. \- Change Management: Changes to systems within the development lifecycle are managed with formal change control procedures. Significant code changes are reviewed and approved by management prior to production deployment. \- Release Management: Release Checklist must be completed which includes a checklist of all Test Plans which show the completion of all associated tests and remediation of identified issues. Change control procedures include separation of duties between development and deployment tasks. The Chrome browser extension The Chrome browser extension is developed and maintained by Sendoso. All aspects of the solution follow the Sendoso secure SDLC process, including the browser extension. Development environments & test data Sendoso protects all system environments, ensuring production, test/staging and development efforts are logically or physically separated. Customer data is not used for testing purposes…