You Are Safe with Us
+ 25K Users
More than 25K users trust us to safeguard their data
Nonstop Security oversight of our app
99.99% Uptime and continuous backup of customer data
Regulatory Compliance Readiness
CloudExtend is committed to following the most trusted security standards in the world, and proves it with audits and accreditations.
SOC2 – Celigo and CloudExtend’s SOC 2 Type 2 reports
EU and UK GDPR – CloudExtend is GDPR ready: we rely on consent of the individual and one or more of the following legal mechanisms: Standard Contractual Clauses, the EU-U.S. Privacy Shield, the Swiss-U.S. Privacy Shield, and can execute a DPA for customers interested in EU and UK GDPR privacy
CCPA – Celigo’s CloudExtend is CCPA Ready.
FERPA – We manage in-process data securely, so educational institutions and their suppliers can continue to rely on our products for their integrations.
Commonly Requested Data Security Information
Q: Do you store any customer related information?
A: Yes. We may store user name, company name, address, and email for licensing and billing purposes. We also may store account related metadata information. Additionally we capture usage details via 3rd party applications. Examples would include login attempts, number of records updated, type of record updated.
CloudExtend Excel for NetSuite may persist data on Amazon S3 when uploaded via “Burst Mode”. Data is persisted only until it has been processed by NetSuite and downloaded by the user after which it is immediately deleted from S3. The data is encrypted on write with Amazon S3-Managed Encryption Keys SSE-S3).
Q: Do you ensure that all data stored and transferred is encrypted?
Q: Has a data encryption and storage policy and procedure been defined?
Data is hosted in Amazon’s Web Services Data Centers. A brief summary is below and detailed physical security documents are available here.
Amazon has very strict rules regarding access to the physical premises of their data centers. Only approved employees are authorized to enter and 3rd party access is scrutinized based on the principle of least privilege where request must specify to which layer of the data center the individual needs access, and are time-bound. Entry gates are staffed with security officers, monitors, and cameras. Entry badges for approved visitors requires multi-factor authentication. Physical access to AWS data centers is logged, monitored, and retained. Entrances to server rooms are secured with devices that sound alarms to initiate an incident response if the door is forced or held open. Additionally, electronic intrusion detection systems are installed within the data layer to monitor, detect, and automatically alert appropriate personnel of security incidents. Ingress and egress points to server rooms are secured with devices that require each individual to provide multi-factor authentication before granting entry or exit.
When a storage device has reached the end of its useful life, AWS decommissions media using techniques detailed in NIST 800-88. Media that stored customer data is not removed from AWS control until it has been securely decommissioned.
Q: Is the hosting infrastructure protected by a firewall?
A: Yes. The firewall is enabled in the AWS infrastructure
Q: Is there an IDS or IPS monitoring the network?
A:Yes. This is enabled in the AWS infrastructure
Q: Are servers on dedicated network segments?
A: No. Our infrastructure is hosted on Amazon AWS
Q: Do servers with customer data enforce a minimum password length of 8 or more characters?
A: Yes. A minimum of 128 bit security keys are used to access AWS.
Q: Is two-factor authentication (2FA) used?
A: Yes. For access to AWS security console 2FA is enabled
Q: Is a Host Intrusion Detection System used?
Q: Does the organization require a minimum password length of 8 or more characters?
Q: Is there a password rotation policy?
A: No. No rotation policy for user desktops/laptops. Rotation policy applies for master password to the cloud Identity and Access Management provider used for accessing all other systems / software. Policy requires that the master password is never stored (saved) by the user
Q: Is two-factor authentication used?
A: Yes. Access to cloud IdP is protected by 2FA
Q: Does the organization require all desktops to have antivirus software?
Q: Are all desktop computers part of a domain?
Q: Are users allowed to install applications?
Q: Are users keyboard and monitors recorded?
Q: Are users network activity recorded?
Q: Is there a 24/7 contact number for outages?
A: No. Status updates are provided at status.cloudextend.io. We’ll generally know of outages before customers report them.We have internal processes that monitor our API’s and proactively alert staff on standby. Customers can also report outages on the status page.
Q: Is there a 24/7 contact number for security incidents?
A: No. We’ll generally know of incidents before customers report them. We have internal processes that monitor our API’s and proactively alert staff on standby. Incidents can be reported to [email protected].
Q: Are logs and events monitored?
Q: For planned maintenance, can customer be notified?
Q: For security incidents, can customer be notified?
Ready to get started?
Request a demo or start a trial.
No credit card required.