{"id":12295,"date":"2018-08-13T13:55:26","date_gmt":"2018-08-13T17:55:26","guid":{"rendered":"https:\/\/www.drift.com\/?page_id=12295"},"modified":"2020-12-30T14:32:19","modified_gmt":"2020-12-30T19:32:19","slug":"security","status":"publish","type":"page","link":"https:\/\/www.drift.com\/security\/","title":{"rendered":"Data Security"},"content":{"rendered":"","protected":false},"excerpt":{"rendered":"","protected":false},"author":267,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"page-security.php","meta":{"inline_featured_image":false},"acf":{"hero_section":{"navigation_style":"full_navigation","hero_layout":"text_left_image_right","background_image":false,"background_color":false,"pretitle_image":false,"title":"How Drift Handles Security","paragraph":"","image_or_video":"image","hero_image":false,"include_sign_up_form":false,"form_action":"create_free_account","subtext":"(100% free to get started. No credit card required)","hero_video":null,"button_options":{"button_text":"","button_link":"","button_style":"secondary","open_in_new_tab":false,"button_subtext":""},"image_vertical_alignment":"top","button_text":"","playbook_id":""},"body_content":[{"acf_fc_layout":"text_section","title":"","subtitle":"","body":"<div style=\"margin-top: -132px;\">\n<p>At Drift, we put the Customer at the center of everything we do.  The security of your data is a pillar of this philosophy. We take the privacy and security of your data very seriously and make significant efforts to protect all of your data. Our security program is designed to make security part of our software and company DNA.<\/p>\n<\/div>\n<div class=\"with-border margin-top__sm\">\n<p>Looking for something specific? Here are some reference pages:<\/p>\n<ul>\n<li><a href=\"https:\/\/www.drift.com\/gdpr\/\">GDPR Page<\/a><\/li>\n<li><a href=\"https:\/\/www.drift.com\/privacy-policy\/\">Privacy Policy<\/a><\/li>\n<li><a href=\"https:\/\/www.drift.com\/terms-of-service\/\">Terms of Service<\/a><\/li>\n<\/ul>\n<\/div>\n<p class=\"margin-top__sm\">For deeper analysis, please request a copy of our in-depth Security Questionnaire and our Information Security Policy from your Account Executive or CSM, which aligns to SOC 2.<\/p>\n<h2 class=\"as-h2 bold\">Meet the Security Team<\/h2>\n<div class=\u201cwistia_responsive_padding\u201d style=\"padding:56.25% 0 0 0;position:relative;\">\n<div class=\"wistia_responsive_wrapper\" style=\"height:100%;left:0;position:absolute;top:0;width:100%;\"><iframe loading=\"lazy\" src=\"https:\/\/fast.wistia.net\/embed\/iframe\/r039bf4qtu?videoFoam=true\" title=\u201cWistia video player\u201d allowtransparency=\u201ctrue\u201d frameborder=\u201c0\" scrolling=\u201cno\u201d class=\u201cwistia_embed\u201d name=\u201cwistia_embed\u201d allowfullscreen mozallowfullscreen webkitallowfullscreen oallowfullscreen msallowfullscreen width=\"100%\" height=\"100%\"><\/iframe><\/div>\n<\/div>\n<p><script src=\u201chttps:\/\/fast.wistia.net\/assets\/external\/E-v1.js\u201d async><\/script><\/p>\n<h2 class=\"as-h2 bold margin-top__sm\">Security Objectives<\/h2>\n<p>Our security framework uses best practices in the SaaS industry to support our objectives:<\/p>\n<p><P><strong>Data and information integrity.<\/strong> We ensure that customer information is always secure at any moment, during transit and at rest.<\/p>\n<p><strong>Continuous defense.<\/strong> We maintain availability of our services by proactively minimizing any security risks through continuous penetration, vulnerability, and risk assessments.<\/p>\n<p><strong>Alignment with standards and best practices.<\/strong> Our security practices follow industry guidelines for cloud security.<\/p>\n<h2 class=\"as-h2 bold\">Drift + Your Data<\/h2>\n<p>Drift sits at the very top of your company\u2019s engagement funnel with a purpose to collect lead data from your site visitors and drive sales. The data required to do this is minimal. <strong>Drift does not mine, store, or attempt to access any special or sensitive categories of personal data.<\/strong><\/p>\n<p>Drift collects the following data:<\/p>\n<ul>\n<li>IP addresses<\/li>\n<li>cookie data (only for service functionality; Drift does NOT track users across different domains or create profiles based on online behavior). More information on cookies is available at our <a href=\"https:\/\/help.drift.com\/article\/drift-cookie-security-and-privacy\/\">cookie policy<\/a><\/li>\n<li>Names<\/li>\n<li>Contact information such as business email address, phone number<\/li>\n<li>Company affiliation<\/li>\n<li>Job Title<\/li>\n<\/ul>\n<p>Your organization is in control of this data at all times, including how long we store your data and when we delete it.<\/p>\n<div class=\"with-border margin-top__sm\">\n<p>The Drift application also has the ability to set user permissions to limit access to data export, billing, workflow edits, and other features.<\/p>\n<\/div>\n<p class=\"margin-top__sm\">You may choose to integrate Drift with your company\u2019s systems to provide a seamless lead engagement experience. Whether you connect Drift to Salesforce (to pass along lead data) or Office 365 (to book meetings on behalf of your employees), access is based on OAuth2 and data scopes are limited to only the necessary information for Drift to perform its function.<\/p>\n<p>Lastly, Drift employee access to your data is provided as necessary for customer support.  Access to data is authorized by our Data Protection Officer based on the principle of least privilege and is regulated through our internal information security policies.<\/p>\n<h2 class=\"as-h2 bold\">Data Security &#038; Encryption<\/h2>\n<p>Whether data is being transferred or stored, all customer data is secured with the latest encryption algorithms and technologies. <\/p>\n<p><strong>At rest<\/strong>, all data lives within our Amazon Web Services (AWS) infrastructure located in US-EAST datacenters.<br \/>\nResting data is encrypted using AWS provided technologies, which use a symmetric AES-GCM encryption algorithm with 256 bit encryption keys. Encryption keys are stored separately from encrypted data using AWS\u2019 Key Management System (KMS).<\/p>\n<p><strong>During transit<\/strong>, either externally or internally between Drift services, data is encrypted using TLS 1.2 with AES 256 bit encryption to ensure data protection at all times. Drift SSL certificates are issued through AWS, and when Drift sends data to third-party systems data is encrypted by leveraging the SSL certificates owned by our partners. Drift is certified under the <a href=\"https:\/\/www.privacyshield.gov\/participant?id=a2zt0000000PBbKAAW\" target=\"_blank\">EU\/Swiss-U.S<\/a>. Privacy Shield Framework and all our agreements with sub-processors require that data only be transferred pursuant to Privacy Shield Certifications or mutually executed Standard Contractual Clauses.<\/p>\n<p><strong>Removable storage<\/strong> or hard copies (such as printed records) are not used and are strictly prohibited by our Security Policies.<\/p>\n<h2 class=\"as-h2 bold\">Infrastructure<\/h2>\n<p>Drift is a SaaS platform that is 100% cloud-based in AWS. We do not operate our own physical servers, routers, load balancers, or DNS servers. All of our servers are within our own virtual private cloud (VPC) with network access control lists (ACLs) that prevent unauthorized requests from reaching our internal network. We use intrusion detection with a robust Security Information and Event Management (SIEM) system to immediately identify and respond to any threats, in coordination with 24\/7 pagerduty service. <\/p>\n<p>Customer data is stored in multi-tenant datastores and logically separated. Strict privacy controls exist in our application\u2019s code to ensure data privacy and prevention of cross-customer data access. All data in our system are tagged by account and every request to our system requires account context, enforced by client-side JSON web tokens (JWT). Any attempt to tamper with an open session results in immediate log-out and rejection of all requests.<\/p>\n<h2 class=\"as-h2 bold\">Software<\/h2>\n<p>Security is a critical part of our software development lifecycle (SDLC) and our processes are built to emulate OWASP standards. Drift utilizes separated staging environments, manual code reviews, and automated static code analysis in order to verify code changes prior to deployment.<\/p>\n<p>We have a continuous deployment model so our customers benefit immediately from resiliency improvements, bug fixes, and upgrades. Further, our development process enables immediate prioritization of critical updates and vulnerability remediations.<\/p>\n<h2 class=\"as-h2 bold\">Organization<\/h2>\n<p>We take great care to make security a company-wide initiative. Our Data Protection Officer is directly responsible for our security program and governance process, employee training, and customer transparency. Background checks are a necessary step during the hiring of employees and contractors. Security is a topic in every quarterly planning process and we undergo annual company security training. Outside of our established review cadence, we engage in continuous assessment and iteration to meet the changing needs of our customers.<\/p>\n<h2 class=\"as-h2 bold\">That\u2019s a wrap!<\/h2>\n<p>If you have further questions, please reach out to <a href=\"mailto:infosec@drift.com\">infosec@drift.com<\/a> and we can provide additional detail about the security of your data.<\/p>\n","button_options":{"button_text":"","button_link":"","button_style":"secondary","open_in_new_tab":false},"text_align":"left","width":"narrow","section_padding":true,"image":false,"background_color":false}],"internal_page_name":"How Drift Handle Security","custom_css_file_name":"security.css","include_intellimize":["0"],"inject_into_header":""},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v19.3 (Yoast SEO v20.4) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Drift Data Security &amp; Risk Management Overview<\/title>\n<meta name=\"description\" content=\"At Drift, we put the Customer at the center of everything we do. The security of your data is a pillar of this philosophy.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.drift.com\/security\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Data Security\" \/>\n<meta property=\"og:description\" content=\"At Drift, we put the Customer at the center of everything we do. The security of your data is a pillar of this philosophy.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.drift.com\/security\/\" \/>\n<meta property=\"og:site_name\" content=\"Drift\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/heydrift\" \/>\n<meta property=\"article:modified_time\" content=\"2020-12-30T19:32:19+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@Drift\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.drift.com\/security\/\",\"url\":\"https:\/\/www.drift.com\/security\/\",\"name\":\"Drift Data Security & Risk Management Overview\",\"isPartOf\":{\"@id\":\"https:\/\/www.drift.com\/#website\"},\"datePublished\":\"2018-08-13T17:55:26+00:00\",\"dateModified\":\"2020-12-30T19:32:19+00:00\",\"description\":\"At Drift, we put the Customer at the center of everything we do. The security of your data is a pillar of this philosophy.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.drift.com\/security\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.drift.com\/security\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.drift.com\/security\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.drift.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Data Security\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.drift.com\/#website\",\"url\":\"https:\/\/www.drift.com\/\",\"name\":\"Drift\",\"description\":\"The World&#039;s First and Only Conversational Marketing and Sales Platform\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.drift.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Drift Data Security & Risk Management Overview","description":"At Drift, we put the Customer at the center of everything we do. The security of your data is a pillar of this philosophy.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.drift.com\/security\/","og_locale":"en_US","og_type":"article","og_title":"Data Security","og_description":"At Drift, we put the Customer at the center of everything we do. The security of your data is a pillar of this philosophy.","og_url":"https:\/\/www.drift.com\/security\/","og_site_name":"Drift","article_publisher":"https:\/\/www.facebook.com\/heydrift","article_modified_time":"2020-12-30T19:32:19+00:00","twitter_card":"summary_large_image","twitter_site":"@Drift","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.drift.com\/security\/","url":"https:\/\/www.drift.com\/security\/","name":"Drift Data Security & Risk Management Overview","isPartOf":{"@id":"https:\/\/www.drift.com\/#website"},"datePublished":"2018-08-13T17:55:26+00:00","dateModified":"2020-12-30T19:32:19+00:00","description":"At Drift, we put the Customer at the center of everything we do. The security of your data is a pillar of this philosophy.","breadcrumb":{"@id":"https:\/\/www.drift.com\/security\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.drift.com\/security\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.drift.com\/security\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.drift.com\/"},{"@type":"ListItem","position":2,"name":"Data Security"}]},{"@type":"WebSite","@id":"https:\/\/www.drift.com\/#website","url":"https:\/\/www.drift.com\/","name":"Drift","description":"The World&#039;s First and Only Conversational Marketing and Sales Platform","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.drift.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/www.drift.com\/wp-json\/wp\/v2\/pages\/12295"}],"collection":[{"href":"https:\/\/www.drift.com\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.drift.com\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.drift.com\/wp-json\/wp\/v2\/users\/267"}],"replies":[{"embeddable":true,"href":"https:\/\/www.drift.com\/wp-json\/wp\/v2\/comments?post=12295"}],"version-history":[{"count":1,"href":"https:\/\/www.drift.com\/wp-json\/wp\/v2\/pages\/12295\/revisions"}],"predecessor-version":[{"id":84201,"href":"https:\/\/www.drift.com\/wp-json\/wp\/v2\/pages\/12295\/revisions\/84201"}],"wp:attachment":[{"href":"https:\/\/www.drift.com\/wp-json\/wp\/v2\/media?parent=12295"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}