Data protection and security
Your data is unique. Your privacy is valuable. Here's what we do to protect them...
How we go beyond what’s expected of modern security
Alerts aren’t enough. We use state-of-the-art techniques to stay ahead of hackers.
All our data is classified and restricted, which lets us prioritize the most sensitive information. Single-tenancy architecture means that each person’s data is kept separate from everyone else’s. Along with secure, world-class data centers, this data separation helps keep your data secure.
Authentication and access security
Personnel have the exact level of access required, and user access is regularly audited to ensure data protection. In keeping with National Institute of Standards and Technology (NIST) requirements, data access is protected by multi-factor authentication, password control, keys, and other best practices.
Access zone security
Our networks use a layered access classification framework to provide data separation. Each client-protected single tenancy data store, whether physical or virtual private cloud, is a fully security-hardened stack that includes endpoint and network threat prevention, application firewalling, and vulnerability scanning.
Secure software development lifecycle
Security is baked into our software development—developers are active participants in securing the code that they write. Security scanning tools and code analysis help them resolve any issues with open-source packaging, misconfigurations, and potential vulnerabilities.
Internal offensive security
Our in-house Red Team engages in continuous penetration testing. We try to break our own production systems every day—so that we can stay ahead of the curve and address potential issues.
Security is built into our software development lifecycle
Security starts before the first line of code. That’s why we bake security into every stage of our software development lifecycle (SDLC).
Our developers consider security from day one. We consider common security flaws and exploit techniques at the beginning of our SDLC
Security scanning tools
Developers use embedded security scanning tools in their deployment process. Static code analysis and open-source package management let us flag potential issues or vulnerabilities.
Daily vulnerability scans
We scan our product daily, to flag and correct potential vulnerabilities as quickly as possible (using dynamic analysis).
Continuous pen testing
Every day, we try to hack our own systems. Our offensive security team thinks like hackers to find and address potential issues.
Security community experts
We’re involved in the security community at the local, national, and international level. Our team consists of active contributors to OWASP.
SOC 2 report request form
We are committed to protecting and safeguarding your data with full transparency into security, privacy and compliance controls at ActiveCampaign. If you would like to request our latest available SOC 2 report, please complete the form found at the link below and we will be in contact with you shortly after.Submit your SOC 2 request form
For cutting-edge security, we built a cutting-edge team
We built a team with world-class security skills. Our team includes experts with experience in compliance and privacy, risk, threat exposure management, application security, secure cloud and infrastructure, incident response, and red teaming.