SupportLogic Data Integration Guide
The process of integrating your data is designed to be secure, granular, non-intrusive, and flexible.
Download Datasheet
SupportLogic Security Overview
Overview
SupportLogic SX™ is designed Security First to ensure the sustained protection of your data. From end to end, our processes and systems are employed to keep your data secure and maintain a track record of zero breaches or loss of data. Machine learning (ML) and natural language processing (NLP) require large amounts of data to make accurate and actionable predictions, and a secure architecture is critical to ensuring that this technology can deliver as promised.
Security Certifications
SOC 2 Type II & ISO 27001
SupportLogic is SOC 2 Type II and ISO 27001 compliant. The Service Organization Control (SOC) report certifies compliance with the Trust Services Principles outlined by the AICPA and ensures that all policies and procedures meet the industry standard for security.
We regularly conduct both internal and external audits and penetration tests, with complete results available by request. We invite you to run your own security tests on the VPC.
Contact your SupportLogic Sales Representative for the latest annual audit report.
GDPR
SupportLogic is GDPR compliant and committed to the protection of your personal data.
The CRMs we process meet the GDPR, ISO 27001, and CCPA
compliance and certification requirements. Your data is then processed in a single-tenant VPC that also meets these requirements.
Refer to our Privacy Policy for full details on the handling of your personal data.
HIPAA
SupportLogic is committed to a platform that can be trusted by you and your patients. Our data privacy and security protocols conform to the HIPAA Security, Privacy, and Breach Notification Rules and are designed to meet your HIPAA compliance requirements.
Role-Specific Access
Security can never be technology alone. All SupportLogic employees and contractors are trained using comprehensive security awareness programs. All employees and contractors are also required to pass background checks going back 7 years with a full criminal history check, education verification, employment history verification, and reference check. Access to your data is further restricted to a small group of allow-listed employees.
Security training programs strictly define the protocols around SupportLogic workstations, interactions with your data, enforcement, auditing, and reporting. We also perform regular phishing simulations as part of security awareness. SupportLogic employees undergo additional security training based around role-specific requirements. These policies and a Security First mindset form the foundation for maintaining SOC 2 compliance.
- SupportLogic equipment is protected by disk-level encryption, anti-malware/anti-virus software, and a strict password policy. 2-factor authentication (2FA) is strictly enforced on all developer equipment, with transient permissions lasting less than 24 hours. SSO is used on all production equipment.
- The SupportLogic User Authentication Policy ensures that only a select few appropriate users have access to your data. We log all virtual machine (VM) user access and use a bastion host as a gateway between the internal network and the Internet—repelling attacks by running just a single application while all other services are removed.
- Identity and access management (IAM) policies allow tight controls around granting or revoking access to specific resources, managing roles and permissions, delegating trusted individuals, audits, and enforcement.
The management and monitoring of physical access to facilities is an important part of SupportLogic security. Electronic control systems manage access to controlled spaces, and rights are strictly based on an employee’s role. Employee access cards and/or keys are never shared or loaned to others, and access cards/keys are free from identifying information other than a return mail address.
On-site physical access to sensitive or confidential information is controlled through a combination of the following mechanisms:
- Security based on individual job function
- Revocation of all facility access immediately upon termination and collection of keys, access/smart cards, and/or any other asset used to enter SupportLogic facilities
VPC Hosting
Your SupportLogic SX deployment resides entirely in an isolated virtual private cloud (VPC) instance. The VPC ensures a high level of security and protects your data through the use of perimeter control, ingress and egress rules, and context-aware access based on client attributes. SupportLogic also supports the ability to host on a dedicated private cloud.
For the standard VPC deployment, data center access is maintained at the highest standards of security.
SupportLogic SX Secure Architecture
VPC Data Handling
Access
Access to your data is strictly limited to SupportLogic employees that require access to perform role-specific duties. No data is shared, nor any documents or data derived from your data, with anyone except the SupportLogic employees specifically assigned to your projects.
Employees can only store your data in approved locations, and cannot use your data for anything except troubleshooting or approved projects. Employees are strictly prohibited from copying or storing any data that contains legally sensitive or personally identifiable information, including medical or financial data.
Data is securely deleted when your contract expires or is canceled. Any screenshots or other similar data is edited to redact/black-out any identifying information before storing in other systems.
In case of off-boarding, SupportLogic stores only metadata and/or minimal, anonymized data as directly relevant to making ML predictions. In these cases, we do not store complete copies of your CRM data for ML purposes. Upon request, data can be deleted within 3 business days.
Usage
The data used by SupportLogic to train ML models is primarily composed of metadata and/or data created within the SupportLogic data platform. Metadata created within the SupportLogic data platform includes anonymized product usage and telemetry data. We do not use native CRM data to train machine learning models across environments.
This created data is used to improve the product for end users (for example, improving pages that are most frequently used based on usage data; speeding up the slowest API requests based on telemetry data) and also for ML purposes. This data is not shared with third parties except in the case of highly aggregated data shared with limited audiences (namely, for example, the number of unique users that log into all SupportLogic instances on a month-by-month basis).
Data is only created within the SupportLogic data platform as a result of direct user action by SupportLogic users. Examples include additional support case comments (which may optionally be written back to the CRM) or actions taken through the SupportLogic UI that result in changes that are written back to the system of record.
Regarding ML modeling, metadata and anonymized data used to train ML models outside of your specific data environment from which they originate consists of user-originated feedback about the accuracy and/or validity of ML model predictions and derived input and output data of the ML model used for prediction.
Data Pipeline
SupportLogic SX consists of three elements: a lightweight data connector (ELT), a cloud platform, and a web UI. The data connector extracts from your CRM source using the authentication token provided by you. All data collection happens securely over SSL using REST APIs and all three elements are hosted in the secure VPC.
The ELT stage forces all access through a limited authentication token. SupportLogic employee access to your data is controlled through self-service OAuth via the VPC. This way, your user permissions are preserved and access is controlled both internally and externally. Complete control over data permission always resides with you, as no credentials are ever shared. Access to your data is enabled or disabled from a single, secure access point.
The recommended API write back is secured according to your CRM system’s capabilities. Salesforce Service Cloud uses OAuth, Zendesk uses token-based APIs, and Microsoft Dynamics uses a Client ID/Client secret token exchange.
For additional information on the data pipeline, see the Data Integration Guide.
High-Level Data Pipeline View
ETL At a Glance
- All transmissions encrypted using industry best practices (TLS 1.2+)—both at rest and in transit
- Compliant with SOC 2 Type 2, ISO 27001, PCI DSS, EU 94/95 privacy rules, GDPR, and HIPAA standards
- Access controlled through self-service OAuth tokens
- Data transit protected by ephemeral keys and HSM-backed master keys
- Column masking to exclude certain data
- Full transparency with connector-level logs and anomaly detection
Software Development Lifecycle (SDLC)
A stringent SDLC policy ensures that the development team understands the importance of security and is well-versed in standard software development practices. While all data is hosted in the public cloud infrastructure, the SDLC is used to:
- Understand all data being input, processed, retained, and served
- Develop a minimum security criteria
- Perform routine risk assessment
Core SDLC Elements
- Design: Architect for security and embrace simplicity. SupportLogic architecture is designed to minimize attack surface and rely on failsafe defaults. We use the principle of least privilege and conduct routine threat modeling.
- Development: The SupportLogic security team is vigilant about proliferating the use of approved tools and libraries. We take action to deprecate unsafe functions and perform routine static analysis.
- Testing: The security team performs dynamic analysis, fuzz testing, and regular reviews around final attack surfaces.
- Response: All production instances are monitored and equipped to follow IRP in case of breach.
Encryption Protocols
All data in the VPC is encrypted both At Rest and In Transit using HTTPS (TLS 1.2) and 2048-bit RSA SSL certificates signed with SHA256.
In transit, your data is encrypted before transmission. The system endpoints are then authenticated and the data is decrypted and verified on arrival. This protocol protects data in the event communications are intercepted while data moves between two systems.
At rest, your data is encrypted to protect from a system compromise or data ex-filtration.
Each VPC instance handles the encryption protocols and is fully FIPS 140-2 compliant. KMS is used to manage encryption keys for cryptographic functions and bulk data encryption. Specifically, the service encrypts third-party tokens that grant employee access to your data. This service enables a provable and monitorable root of trust (RoT) over all data in the system.
Security Audit
Penetration tests are used periodically to proactively address security gaps. These tests are the backbone of the information security audit. Both the SOC 2 audit and annual penetration test are renewed on an annual basis.
Audit vendors run two types of penetration tests: Network and Web Application. Each test has three risk ratings (Low, Medium, and High) with a risk score from 0 (lowest) to 40 (highest). The lower the risk score the better. The most recent tests received a risk score of 0 (the lowest possible) for the Network Penetration Test and a score of 1 for the Web App Penetration Test.
Collection Information
SupportLogic uses a combination of custom developed and commercial applications. These run on enterprise-grade server platforms supported by commercial databases. Redundancy is maintained for all components of the infrastructure, including firewalls and servers. This setup was developed to quickly enable the addition of bandwidth and server capacity to support your requirements. External services and internal applications constantly monitor communications, job logs, system performance, and security.
Data is collected from a variety of sources. This information is combined to help tailor communications and to develop and improve solutions. Refer to the Information Classification Policy for full policy details.
Information Security
All information—including machines, data, code, documents, and intellectual property—are treated and managed as valuable resources. The compliance and
effectiveness of the following information security policies are measured using periodic reporting.
Access
- Any security weaknesses in SupportLogic software or technical infrastructure is logged as an issue.
- Any violation of SupportLogic security policies is reported to the EVP of Engineering.
- Attempted access to any data, document, email correspondence, or program contained on
SupportLogic systems without authorization are prohibited. - Access to your data is limited to employees that require access to the data to perform approved duties.
- The sharing of your data, or any documents or data derived from your data, with anyone except your employees and the SupportLogic employees
specifically assigned to your projects is prohibited.
Credentials
- Sharing accounts, passwords, or any information or devices used for identification and authorization purposes is prohibited.
- Any remote access must be secure, and encryption and strong passphrases are mandatory.
- All corporate passwords must be strong (at least 8 characters and at least one numeric and one special character).
Storage
- SupportLogic avoids copying or storing any data that contains legally sensitive or personally identifiable
information, including medical or financial data. Identifiable data never leaves the VPC. - Your data is only stored in approved locations, and only used for troubleshooting or approved projects.
- Your data is securely deleted when your contract expires.
- All data on laptops is encrypted at either a file or file-system level. SupportLogic laptops are kept up to date with all relevant security patches.
- All BYOD systems (mobile phones) that contain
SupportLogic information are configured with a secure password and kept up to date with software patches.
Management
- Unauthorized copies of copyrighted or SupportLogic-owned software are prohibited.
- The loss of any device containing SupportLogic data is immediately reported to the EVP of Engineering.
- Any open-source software used for the development of SupportLogic products must obtain the approval of the EVP of Engineering and must adhere to the terms of the open-source license.
- Any changes to information resources are managed and executed in accordance with a formal change control process.
- Any activity that may harass, threaten, or abuse others or intentionally access, create, store or transmit material which SupportLogic may deem to be offensive, indecent or obscene, or that is illegal according to local, state or federal law is prohibited.
Monitoring Policy
Process is at the core of SupportLogic security. A continuous monitoring program is used to ensure the security compliance of the systems processing your data. The SupportLogic Continuous Monitoring Program is comprised of the following elements:
- Code Security Coverage: Identifies potential software vulnerabilities. Code vulnerabilities are reported upon check-in.
- Container Monitoring Service (CMS): Tracks the network throughput of applications hosted on each VPC instance.
- VM CVE Updates: Addresses security vulnerabilities with critical patch updates.
- Intrusion Detection System: Continuously monitors all networks and systems for malicious activity or policy violations.
- Web Application Firewall (WAF): Ensures security protocols on application network traffic, protecting APIs against common threats that may attempt to affect applications.
- Log Monitoring and Post-mortem: Used to understand all root causes and thoroughly document incidents for future reference and pattern discovery.
Operational Resiliency
Risk Assessment
Risk assessment is regularly performed as part of an overall risk management process. The goal is to uncover any vulnerabilities, both technical and non-technical, and develop practical strategies to minimize these risks. These assessments are conducted through an internal review process in conjunction with clearly defined objectives. To ensure it becomes part of the fabric of a risk management program, these assessments are performed annually and reviewed for modifications.
Service Resiliency
All internal business data (including, code, bug/feature databases, documentation, and configurations) is hosted online through cloud-based service providers. The data hosted on cloud-based service providers is protected against outages through best practices. Our technical operations team is responsible for updating the SupportLogic application, applying OS updates, performing backups, and performing restores in the event of an outage. Technical operations maintain a 24-hour recovery point objective (RPO) and 30-minute recovery time objective (RTO) for production systems.
SupportLogic uses best-of-breed third-party vendors. Vendor SOC reports and business recovery plans are regularly reviewed to ensure these tools meet all requirements.
Frequently Asked Questions
Is my data secure during extraction?
Yes – All data is encrypted in transit using TLS 1.2 (and above).
Is my data secure in your platform?
Yes – At rest, your data is encrypted under the 256-bit Advanced Encryption Standard, and each encryption key is itself encrypted with a regularly rotated set of master keys.
Is the data integration secure?
Yes – Only you can give access to your data by inviting new users to your account or by engaging a third party and explicitly providing access to your data. This access is used to run analytics against your data, with the option to write back to your CRM using SupportLogic SX as a bidirectional solution. Via the ETL, you have the ability to grant or revoke visibility permissions and can remove access permission at any time.
Can I use SSO or Active Directory?
Yes – You can use many industry-standard SSO and Active Directory providers.
What data is collected?
The following data types are collected from your CRM system:
- Case details, notes, comments, and discussions
- Case requester details
- Agent details
- Product usage metrics
Can I delete my data from SupportLogic?
Yes – When your account is terminated, SupportLogic will mark all your data for eventual deletion. However, by request your data can be deleted within 3 business days. Send a request to hello@supportlogic.io with the details of the support case. SupportLogic will delete the case data and send you a confirmation email within one business day.
Is data stored by SupportLogic?
Your data is only stored in your VPC instance.
SupportLogic only uses your data for generating the ML models tuned to your organization. Your data is not used to train any other models. Once the models are created the collected data is not needed, SupportLogic may store data to continuously improve your models. SupportLogic can purge any data by request.
Does SupportLogic store sensitive information like usernames and passwords?
SupportLogic does not require login details or a password to your CRM system. However to use the SupportLogic application we require that you to create an account on our platform.
There are two options for account creation: you can create individual user accounts using your email address or sign in with your existing Slack credentials. If you sign in with Slack we collect your profile information.
You might also be interested in
Don’t miss out
Want the latest B2B Support, AI and ML blogs delivered straight to your inbox?