Security and Reliability

Standardized Security Processes

Salsify maintains standard security policies and processes. The policies, standards, and procedures are reviewed at least annually and updated as necessary. Our security framework is built based off of NIST 800 recommendations.

Salsify arranges for rigorous third-party security assessments to be conducted at least once per year, including network and application vulnerability threats, penetration testing, and application security framework controls auditing. A letter of attestation of the test can be furnished upon customer request.

We have a formal, management approved Incident Response and Security Incident Response plans. The Incident Response Plan defines the roles and responsibilities for the Incident Commander and supporting roles, as well as the response process, including customer notification, as well as a postmortem process to capture remediation actions. The Security Incident Response plan defines the security incident response team (SIRT) roles and responsibilities, as well as response plan steps.

Software Development Lifecycle (SDLC)

Salsify utilizes an agile development process with Continuous Integration (CI). Our CI pipeline includes development, staging, and production environments. This configuration allows for authorized access controls per environment.
Security is built into each step of our process. Data handling, code deployment, configuration, and patch management each follow security best practices outlined in our security policies and SDLC.

Our SDLC requires code review and approval for all changes, as well as a green build on all automated tests in our CI environment before deployment. All developed code is reviewed manually and automatically tested for potential security vulnerabilities. We strive to follow OWASP (Open Web Application Security Project) best practices.

Identified and confirmed security vulnerabilities go through an impact and risk assessment. Patches or other means of remediation are first deployed in a development environment, tested in staging, and then sent into production.

In addition, automated application penetration tests are run internally on a regular basis.

Administrative Controls

Salsify follows the principle of “least privilege”. Our practice is to only issue credentials to the individuals, and systems that absolutely need access to a system or resource. Access can only be granted by a member of our Operations team and is tracked for auditing purposes. Administrators can revoke access at any time; this supports our off-boarding process.

High-Availability Architecture

Salsify hosts all services on resilient and elastically scalable infrastructure, using a fault tolerant application architecture. This ensures high availability and consistent application performance, as described in our Terms of Service.

Our cloud service providers adhere to industry standard compliance, certifying in ISO 27001, SOC 2 or similar. We obtain and review these reports on an annual basis to confirm compliance.

All SSL certificates are created and updated with 2048-bit key length and SHA-256.

Our keys are encrypted and stored using a key management service.

Disaster Recovery

Our infrastructure architecture supports a recoverable process. Automated data backups, documented recovery procedures and annual testing ensures that we have everything in place in the event of a disaster.

Salsify has a defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for our service.

Authentication & Authorization

Salsify utilizes a cloud service provider solution which includes multi-factor authentication in order to access environments. User defined groups and roles follow our “least privilege” concept. 

Remote access to infrastructure is restricted to only authorized users and is accessible only through our VPN.

Log monitoring is in place and we retain audit logs in accordance with our retention policy. Any suspicious activity or unauthorized access triggers alerting to our operations staff. The security team is engaged, as necessary, per our Incident Response plan.

Passwords are rotated on a regular cadence for staff that supports our infrastructure.

Customer Data

We host customer data in a multi-tenant environment. Data segregation is supported at the application level, per customer. This prevents the potential of exposing customer data to unauthorized users at other organizations.

All traffic is encrypted with a minimum of TLS V1.2. Salsify implements the latest encryption algorithms. We test and upgrade to newer and more secure standards as they become available. We currently use 256-bit AES encryption including the key management service as part of our cloud service provider’s offering.

Data is also encrypted at rest including our system and database backups.

Access to customer data is only provided to authorized personnel.

Authentication & Single Sign-On (SSO)

If you need to report a security concern please email: security@salsify.com.