New Research: What’s Really Happening with Search, Dark Social, and AI
Get the Report

Chartbeat Terms of Service

Technical and Organizational Security MeasureDetails
Measures of pseudonymisation and encryption of personal dataAll web login interfaces utilize HTTPS encryption, adhering to industry-standard algorithms and certificates.
Where feasible, sensitive data is stored under encryption. Passwords and other highly sensitive information are hashed and salted. Data at rest is encrypted using the AES-256 algorithm.
Employee laptops are secured with full disk AES-256 encryption.
Credentials are securely transmitted by default using TLS 1.2 or higher. 
Access to operational environments mandates the use of secure protocols such as HTTPS.
Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and servicesAdherence to widely recognized standards including but not limited to ISO 27001 and SOC 2

– Use of Virtual Private Network (VPN)
– Implementation of strict access controls following the ‘Principle of Least Privilege’.
– Employees are granted only the necessary access required to perform their job functions.
– Unique accounts and role-based access controls are applied within both operational and corporate environments.
– Authorization requests are regularly tracked, logged, and audited.
– Access is promptly revoked upon an employee’s termination or change in employment status.
– Multi-factor Authentication (MFA) is enforced for accessing critical and production resources.
– Strong, complex passwords are mandatory.
– Processes are in place for account provisioning and de-provisioning.
– Duties and responsibilities are segregated to minimize the risk of unauthorized or accidental changes or misuse.
– Confidentiality obligations are enforced for all employees.
– Mandatory security training for employees covers data privacy, protection, confidentiality, social engineering, password policies, and overall security responsibilities both within and outside of Chartbeat.
– Non-disclosure or DPA agreements are enforced with third parties.
– Network segmentation is applied based on varying trust levels.
Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incidentTo ensure the ability to restore availability and access to personal data promptly in the event of a physical or technical incident, we implement regular backups, disaster recovery plans, and failover mechanisms. These measures are tested periodically to confirm effectiveness and to ensure minimal disruption in case of an incident.
Processes for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures in order to ensure the security of the processingMaintain updated security audit certifications and conduct annual external penetration testing.
– FatTail SOC1 Type II and SOC2 Type II
– Chartbeat SOC2 Type II
– Lineup ISO27001 and ISAE3402 Type II
– Tubular Labs SOC2 Type I
Measures for user identification and authorizationImplementation of unique user IDs for all individuals accessing the system.

Enforcement of Multi-Factor Authentication (MFA) for user access.

Role-based access controls to limit permissions based on job function.

Regular auditing and logging of user access and authorization activities.

Use of strong, complex passwords with periodic expiration and renewal.
Secure processes for user account provisioning and de-provisioning.

Mandatory use of single sign-on (SSO) where applicable.
Session timeouts and automatic logouts after periods of inactivity.
Measures for the protection of data during transmissionEncryption of data in transit using industry-standard protocols (e.g., TLS 1.2 or higher).

Use of secure communication channels such as HTTPS and VPNs.
Measures for the protection of data during storageEncryption of Personal Data during storage (i.e., at rest) using a minimum of AES-256.
Measures for ensuring physical security of locations at which personal data are processedPersonal Data is only hosted in facilities with the highest guarantees and certifications (ISO 27001:2013, SOC 2 Type II, etc.).
Measures for ensuring events loggingEvent logging is ensured through SaaS application service providers. Logs are securely stored, encrypted, and regularly reviewed to detect and respond to any anomalies or security incidents. Automated alerts are configured for critical events, and audit trails are maintained to support compliance and forensic investigations.
Measures for ensuring system  configuration, including default configurationSystems are configured according to documented Maintenance of documented security baselines for all authorized operating systems, software applications, and network devices 
Measures for internal IT and IT security governance and managementDedicated InfoSec Team, lead by VP, IT and Infosec. of Information Security, who is empowered by senior management to take the necessary actions to establish, implement, and oversee the program management program based on generally accepted frameworks such as the ISO 27000, NIST Cybersecurity, and CIS Controls, including but not limited to, mobile device policies, incident response management policies, acceptable use policies, asset management policies, and change management policies.
Measures for certification/assurance of processes and productsPolicies and procedures to ensure compliance with applicable legislative and regulatory requirements; Maintain updated security audit certifications and conduct annual external penetration testing.
– FatTail SOC1 Type II and SOC2 Type II
– Chartbeat SOC2 Type II
– Lineup ISO27001 and ISAE3402 Type II
– Tubular Labs SOC2 Type I
Measures for ensuring data minimisationPrivacy assessments are conducted with relevant stakeholders (including the Data Protection Officer, where applicable) before new products and services are implemented to ensure that Personal Data collection is limited to what is necessary for the specified processing purposes.

Security protocols are in place to restrict access to the minimum level required to perform necessary functions.

Data retention is controlled.

Access to personal data is restricted to relevant parties based on the “need to know” principle, with differentiated access profiles created according to functional roles.
Measures for ensuring data quality
Established a process that enables individuals to exercise their privacy rights, including the right to amend and update their information, as outlined in Chartbeat’s Privacy Policy.

Measures for ensuring limited data retention
To ensure limited data retention for internal data, we store personal data only for as long as necessary to provide the services, meet the company’s legitimate business needs, or as required by applicable law or regulation
Measures for ensuring accountabilityPrivacy assessments are mandatory when introducing any new product or service that involves processing personal data. Where relevant or required, we also conduct Data Protection Impact Assessments.

Maintain data inventory (record of processing) that identifies all locations where a Data Subject’s Personal Data is stored.
Measures for allowing data portability and ensuring erasureClauses in the contract mandate adherence to applicable privacy requirements and the implementation of industry best practices for technical and organizational security measures, which must be flowed down to relevant parties.
Technical and organizational measures of subprocessorsComprehensive Vendor Management Policy in place. This policy includes a thorough risk assessment process to evaluate the security posture of all subprocessors before engagement. As part of this process, we require subprocessors to adhere to stringent security standards and implement necessary technical and organizational measures to protect personal data.

Additionally, we ensure that each subprocessor enters into a Data Processing Agreement (DPA) that clearly outlines their obligations regarding data protection and compliance with applicable laws. Regular audits and assessments are conducted to monitor compliance, and any identified risks are addressed promptly to maintain the integrity and security of personal data throughout our supply chain.