Lead Gen & CRM Data Protection: Information Security Overview

This article provides an overview on security information pertaining to the internal controls at Constant Contact and the services that Lead Gen & CRM provides to customers. This article is meant for Lead Gen & CRM direct customers, agency partners, and potential prospects. Agency partners should use the information contained in this document to answer basic security questions their customers may have.

---

Article Contents

• Information Obsolescence
• Glossary
• Standards, Regulatory Measures, and Compliance
• General Data Protection Regulation Compliance
• Data Protection
• Information Security Management System
• Lead Gen & CRM Information Security Policy
• Internal Organization
• Human Resources
• Physical and Environmental Security
• Data Backup and Monitoring
• Access Control
• Systems Development and Maintenance
• Business Continuity and Disaster Recovery
• Vulnerability Assessment and Management

Available With:

Trial	✓
Essential	✓
Advanced	✓
Ultimate	✓

Toolbar:

N/A

Users:

Administrators	✓
Company Managers
Marketing Managers
Sales Managers
Salespersons
Jr. Salespersons

Information Obsolescence

Constant Contact gives the information contained in this article in good faith only and without any warranties or representations as to the accuracy or completeness of the information. 

Constant Contact expressly excludes all warranties, conditions, and other terms implied by law; and all liability for losses arising from customer, partner, or third-party reliance on the information contained in this article. This does not affect Constant Contact's liability for fraud or fraudulent misrepresentation, or any other liability, which cannot be excluded or limited under applicable law.

The information in this article is subject to change at any time, and Constant Contact will use reasonable endeavors to update this information on a regular basis.
 

Glossary

The following table contains terms used with data protection at Constant Contact.

Constant Contact is regulated by the United States Securities and Exchange Commission and goes through yearly audits by a registered third-party auditor to ensure compliance.

Constant Contact's policy on the classification and safe handling of data is a defined Information Classification Policy that identifies all customer data as confidential. It also addresses the marking and handling requirements of documentation.

All sensitive data shared between the application, extranet, tracking endpoints, and servers is transferred using Transport Security Layer (TLS) protocols with up-to-date ciphers utilizing (a minimum of) 256-bit RSA encryption keys. Credentials are stored in an encrypted on-disk format to prevent the data from being compromised in the event that a data theft or data breach incident occurs.

Information Security Management System

Constant Contact conducts risk assessments with regards to confidentiality, integrity, and availability. As part of the Constant Contact Security Framework, the impact resulting from loss of confidentiality, integrity, and availability of assets is assessed as part of the organization’s Risk Management procedures.

Constant Contact considers the availability of the customer solution from the perspective of network and hardware uptime and the availability of services to be of the highest importance. Constant Contact's hosting providers—Google Cloud Platform (GCP) and Amazon Web Services (AWS)—each provide particularly strong controls, processes, and configurations aimed to ensure maximum possible uptime.

Constant Contact's Information Security Management System (ISMS) uses a risk-based approach to implementing and monitoring security controls where requirements are deemed necessary. The Framework is continually extended and improved upon via policies, controls, user education. The general steps that are repeated and followed are as follows: PLAN, DO, CHECK, ACT.

Constant Contact is not certified under the ISO 27001 framework and thus cannot provide proof of certification. That said, Constant Contact places utmost importance upon ensuring the security of its own data and extending the same protection as a service to customers. Every aspect of Constant Contact's web application architecture, product design, security mechanisms, and internal processes have been established in accordance with ISO/IEC 27001 specifications.

Lead Gen & CRM is hosted almost entirely within the Google Cloud Platform and utilizes their Virtual Private Cloud network. The only interfacing networks are Constant Contact offices over a secure virtual private network (VPN), which is strictly controlled. Constant Contact hosts the entirety of its server architecture within Google Cloud Platform data centers and utilizes additional services with Amazon Web Services:

• Google has earned ISO 27001 certifications for the systems, applications, people, technology, processes, and data centers serving Google Cloud Platform.
• Amazon Web Services ISO 27001 certification increases total in-scope services to 33. 

Lead Gen & CRM Information Security Policy

Constant Contact has a documented Security Policy—and related policies—to keep infrastructure secure. These policies typically are not available to customers since the documents are classified as proprietary according to the Constant Contact Information Classification Policy. The Constant Contact Information Security Policy is reviewed, at a minimum, annually (or sooner as a significant changes occur) to ensure its continuing accuracy, adequacy, and effectiveness. In order to ensure that customer data remains secure, Constant Contact addresses the following critical security areas: physical security, network infrastructure, and security operations.

Constant Contact prohibits sharing of policies and procedural documentation with current or potential customers. All Constant Contact policies are considered to be proprietary information according to Constant Contact's Information Classification Policy. As such, information contained in these documents is considered proprietary. Sharing them could jeopardize the security of customers and infrastructure.

Security for network infrastructure is ensured through proper implementation of industry security standards (authentication, authorization, high-grade encryption, multiple security controls, firewalls, packet filters, intrusion detection/prevention systems, continuous monitoring and auditing). Constant Contact's operational security consists of business processes and policies which follow security best practices in order to limit access to confidential information and maintain strong security over time.

Internal Organization

Constant Contact's site reliability engineering (SRE) and system security actively supports information security within Constant Contact through clear direction, demonstrated commitment, explicit assignment, and acknowledgement of its—and everyone else’s—information security responsibilities.

Constant Contact has assigned responsibility for information security to the Information Security Team. The Information Security Team has collectively reviewed and approved the ISMS, which demonstrates the commitment to the establishment, implementation, operation, monitoring, review, maintenance, and improvement of the ISMS. The Information Security Team coordinates with Constant Contact's Legal Team to ensure compliance with all local, state, and federal laws and regulations that affect Constant Contact. The Security and Legal teams regularly meet to discuss new regulations that could impact information security either on a customer or an enterprise-wide level. Additionally, Constant Contact performs regular internal audits upon operations and security controls, processes, and policies. The results of these audits are not available to external parties.

In regards to independent review, Constant Contact's approach to managing information security and its implementation (such as control objectives, controls, policies, rules, processes, and procedures for information security) is independently reviewed at planned intervals, and when significant changes to the security implementation occur. The Constant Contact ISMS is audited internally annually, and a team is responsible for risk assessments pertaining to information security.

Constant Contact performs risk assessments on its suppliers and third parties. Third-party suppliers who are identified as having an impact on the security of Constant Contact's service delivery are assessed. Those vendors or suppliers that are deemed to have a sufficiently high level of risk have formal risk assessments performed on an annual basis to help lower the risk level of the vendor. These assessments are considered as confidential according to the Information Classification Policy and cannot be shared with customers.

Human Resources 

New hire security processes—such as background screening, user account creation, and initial security awareness training—are controlled by formal processes established by the Constant Contact ISMS. In the same fashion, formal off-boarding processes are documented and followed. Termination activities, including exit interviews, revocation of system privileges, disabling of accounts, and recovery of corporate-owned assets are controlled by formal processes established by the ISMS. Access lists for internal critical systems are reviewed periodically.

Constant Contact has implemented security awareness processes and procedures, which include at least bi-annual security awareness bulletin and mandatory security awareness training. Constant Contact understands the importance of how one employee can be targeted in an attack, and that message resonates across the company.

Changes and updates to security policy are communicated to all employees through company-wide emails, intranet bulletins, and through biannual security training. New employees are briefed on the Constant Contact Security Policy during employee orientation, and each employee signs a security acknowledgement form. Each employee is also bound by strict confidentiality obligations, which are embodied within a confidentiality agreement.

Constant Contact information technology (IT) technicians are available on a 24/7 basis to handle any critical system failures that may arise within its IT infrastructure. In order to meet its business needs and ensure the continuity of services, Constant Contact IT technicians are certified in various areas of expertise. 

Physical and Environmental Security 

Physical security measures are in place at Constant Contact data centers and offices. The physical security of Constant Contact's architecture is ensured via its ISO 27001-compliant hosting providers, Google and Amazon. As Constant Contact is hosted entirely within Google, Constant Contact does not deal with external storage. Constant Contact does follow best practices for data integrity and safety, including a robust backup schedule, tested restores, and off-site backups to an entirely different platform. The off-site backups are encrypted and stored within.

Constant Contact does not use a mainframe. However, as mentioned above, Constant Contact uses several distributions of Linux within the application infrastructure. Constant Contact uses several types of datastores, depending on purpose. These include a mix of MariaDB, MySQL, MongoDB, Redis, and some one-off datastores for internal projects, with the majority being dedicated instances of each. Constant Contact does not host its own nameservers. Constant Contact's domain name system (DNS) is hosted by the Google Cloud Platform. For internal DNS, Constant Contact does have some bind servers used by non-production traffic. Most of the email is sent via various third-party services.

Data Backup and Monitoring

The backup policy at Constant Contact requires full backups of customer data daily, with incremental backups being performed each hour. Constant Contact's data retention period for backups of customer data is seven days. Constant Contact replicates these backups to an off-site location in compliance with its own disaster recovery policy. Constant Contact cares about its customers' data, and has placed high availability (HA) mechanisms in place to reduce the need for recovery. Constant Contact makes a best effort attempt to retain customer data. However, Constant Contact does not provide any direct guarantee against loss of customer data.

Constant Contact's backup procedures follow the basic rules of the CIA triad: confidentiality, integrity and availability. They are verified for integrity, are encrypted, are securely transferred, and are stored both at on-site and off-site locations. These backups are then verified through reanimation testing.

Constant Contact utilizes open source technologies, such as Zabbix and OpenVAS, to monitor the availability of its services, obtain web application performance metrics, and perform regular vulnerability scans against its critical infrastructure. Constant Contact also reinforces these processes by regularly performing penetration tests against its own architecture. Constant Contact's monitoring and associated alerting processes are regularly tested to ensure that Constant Contact Network Operations Center (NOC) staff is notified immediately upon the occurrence of any operations anomaly or service interruption.

Access Control

Constant Contact maintains an internal access control policy. The access control policy defines procedures for the creation of new Lead Gen & CRM user accounts and addition of initial privileges and rights, as well as the change and removal of Lead Gen & CRM user privileges and termination of Lead Gen & CRM user accounts. Constant Contact access control policies are based on the principles of least privilege and the segregation of duties. Segregation is enforced through role-based access control policies and technical controls. Virtual local area networks (VLANs) are also used to provide logical segregation of servers, laptops, and departments. 

In addition, Constant Contact has clearly defined information security responsibilities, which are documented in the Constant Contact Information Security Policy. These responsibilities for specific information security procedures are clearly defined and documented in the ISMS. 

As to remote access, Constant Contact permits employees to work remotely in order to facilitate the work-life balance of its employees. Constant Contact allows remote employee access through virtual private network (VPN) authentication, which is secured via Internet Protocol Security (IPSec). A policy is in place to maintain security throughout the remote access provisioning process and to manage security concerns while interfacing with the Constant Contact demilitarized network (DMZ).

Systems Development and Maintenance

Constant Contact infrastructure and development deployments, including source code changes, are peer-reviewed, tested by Quality Assurance (QA) team, and audited before every testing and production release. This is done for consistency and to test potential known vulnerabilities and threats to ensure product stability by using a series of automated and manual tests.

Constant Contact thoroughly tests the content it releases. Using behavior and test-driven development, Constant Contact's dedicated QA team runs simulations on isolated instances of the application to ensure no customer data is accidentally corrupted or contaminated. Once testing has been completed and passed, the QA Manager allows the deployment to be merged into the master build, which gets released as the current live instance which clients will see.
 

Business Continuity and Disaster Recovery

Constant Contact's business continuity management process for recovery in case of incidents or system failures involves ensuring that supporting network infrastructure and customer services quickly resume normal operations after any service interruption event. Constant Contact's business continuity efforts are consistent and reflect industry best practices.

Additionally, documented disaster recovery policy is in place for all facets of the business. These policy and plans will be implemented into the employee security and training programs for 2018.

Elements of the Constant Contact Business Continuity and Disaster Recovery Plan are tested in a staggered fashion in order to minimize the potential of impact on customer service delivery. Testing is performed according to a formal schedule.
 

Vulnerability Assessment and Management

Constant Contact's Vulnerability Assessment team performs internal audits using a combination of both open source and proprietary industry standard level tools—such as OpenVAS and Nessus—to assess the Constant Contact platform's external network footprints. Constant Contact prohibits unauthorized vulnerability assessments or penetration tests performed on Constant Contact services, be it internally or externally.