SECURITY AND COMPLIANCE

We at Gloat are committed to respecting our customers’ and their users’ privacy. Customer trust is of the utmost importance to us, so we offer Enterprise-grade data protection for our customers. Our security program is lead by our Chief Information Security Officer (CISO) and involves members of our engineering, operations, and legal team to include all aspects of cybersecurity and data protection. Our product was built with privacy in mind, to ensure that Personal Data is protected and used properly.

Gloat uses a documented security control framework based upon accepted industry standards for governing the information security practices. These frameworks utilize a standard set of controls and include widespread use of commercially available protective measures. Please visit “Gloat Certifications and Attestations” section for full list of frameworks implemented in Gloat. Gloat developed and is maintaining a set of comprehensive Information Security Policies and enforcement procedures based on the adopted security control frameworks and industry best-practices. The policies reviewed not less than annually or whenever there is a material change in practices or regulatory requirements. Gloat monitors its Policy and procedures to ensure that the program described therein is operating in a manner reasonably required to protect confidentiality, integrity and availability of our customer’s data.

Gloat implemented a formal user registration and de-registration procedure for granting and revoking access to its personnel to processing resources and personal data. Upon termination of any of Gloat’s personnel, the Gloat ensures that such personnel’s access to personal data is revoked. In the event of an involuntary termination, the Gloat ensures all access is revoked immediately. We maintain appropriate access control mechanisms to enable access to personal data and/or Gloat’s processing resources only by Gloat personnel who have a “need to access” to support Gloat’s processing. Additionally, the actual access is granted on “just in time” (JIT) basis, logged and regularly reviewed. Gloat ensures that segregation of duties exists such that the individual or system granting access is not the same individual or system which approves such access. Authentication to Gloat systems managed in the centralized Identity and Access Management solution which enforces strong passwords, Single Sign-on (SSO) and mandatory Multi-Factor Authentication (MFA). The connection to Gloat systems is restricted to Virtual Private Network (VPN) only.

Our Secure Software Development Lifecycle incorporates security – including both automated and manual checks – into each stage of the software development process. The tools and manual efforts that go into security allows us to quickly detect any potential risk, and take the necessary steps to mitigate. Software patches are regularly released as part of our monthly release cycle, with more critical patches released more frequently as necessary. We have a detailed Change Management policy that allows us to be agile and efficient in the event changes need to be made. Key stakeholders and responsibilities for all components of our software development lifecycle are well defined and clearly communicated.

Customer data is stored in Amazon Web Services (AWS) data centers. Our data storage policy is location-agnostic, meaning we can assist our customers in maintaining compliance with data protection regulations such that data can be stored in the relevant geographic region.

Encryption in transit – Gloat encrypts data, records, and files that shall be transmitted wirelessly or travel across public networks with TLS v1.2 or higher protocol. Encryption at rest – Gloat encrypts data at rest. Industry acceptable cryptographic algorithms commensurate with key size are used whenever cryptographic services are applied. All such encryption meets the Advanced Encryption Standard with a 256-bit cypher key (“AES-256”). All encryption keys are protected against modification; secret and private keys are protected against unauthorized disclosure.

Gloat implements and maintains Business Continuity Policy (BCP) and Disaster Recovery Plan (DRP). We test our Business Continuity regularly. Gloat developed and maintained resilient design and architecture of the Services. In order to measure the resiliency and continuously improve services architecture, Gloat implemented and regularly tests Disaster Recovery drills.

Gloat maintains appropriate physical security controls and environmental controls to Gloat controlled facilities, to prevent unauthorized physical access to its controlled facilitates from which personal data can be accessed. Such measures include, but not limited to use of personal access cards identification, door sensors, video surveillance and monitoring. Physical Access control of Gloat data centers is managed by our Cloud Provider, and includes components such as CCTV, authorized access based on a policy of least privilege, access logs, etc. Cloud Provider data centers undergo certification and attestation processes. For more information, please visit Please visit “Third-Party Data Center Certifications” section.

Gloat maintains appropriate mechanisms and processes for detecting, recording, analyzing, and resolving unauthorized attempts to access personal data or Gloat’s systems. Access logs being reviewed periodically to ensure that access permissions are appropriate and necessary. Gloat’s operating system security mechanisms are configured to support appropriate security procedures, and capable to Identify and verify the identity of each authorized user; and Record successful and failed system accesses.

Gloat conducts comprehensive scans for known vulnerabilities on all externally facing systems no less than one time per month. Vulnerabilities are prioritized based on severity and mitigated in accordance with Gloat’s policies. Annual penetration tests on Internet facing assets performed by reputable testing company or on material change. Findings are documented, prioritized and remediated accordingly. Gloat utilizes and keeps current reputable, commercially available anti-malware software on Gloat’s end points.

Gloat developed and is using risk assessment methodology based on industry standard frameworks. We conduct regular risk assessments and reviews the assessments on a regular basis to ensure controls are properly operating. The results of all risk assessments are documented. Gloat develops action plans for the mitigation of findings, and tracks the progress of such action plans.

Our security apparatus includes multi-layer security measures like firewalls, network layer security, application layer security, threat detection and protection, vulnerability scans, access control, encryption, and designed processes to secure our systems and customer data.

Gloat leverages a number of third party applications and services in support of the delivery of our products to our customers. The company’s information assets and vendor dependencies are critical to our continuing operations and delivery of services. Our security team has established a vendor management program and third party vendor security policy that sets forth the requirements to be established and agreed upon when we engage with third parties or external vendors. These engagements are designed to assess the technical, physical, and administrative controls in place and to ensure they are commensurate with the expectations of Gloat and our customers. A full list of our sub-processors is available upon request.