Security / trust page — Simpplr

Cited by

Facts read from this source

• ISO 27001 Report an error

  “Simpplr is ISO 27001:2022 certified annually. An independent firm accredited by the ANAB standards body certifies that the Simpplr information security management system (ISMS) contains comprehensive policies and procedures to manage information risk.”

• SOC 2 Report an error

  “Simpplr annually undergoes a SOC 2 Type 2 audit. An independent auditor regulated by the AICPA investigates our operations during a 12 month period and attests to the effectiveness of our security controls. SOC 2 attestation reports may be shared under NDA. We provide quarterly bridge letters to cover the period since the last SOC 2 audit.”

• Soc3 Report an error

  “SOC 3 reports are similar to SOC 2, but they contain less detail and may be shared publicly without an NDA.”

• Sector laws Report an error

  “HIPPA (US, Healthcare) 23 NYCRR 500 (US/New York, Financial Institutions) FDA 21 CFR Part 11 (US, Life Sciences/Pharmaceutical) GXP (US, Life Sciences/Pharmaceutical) FERPA (US, Education) PCI DSS (Global, Ecommerce)”

• Pci not applicable Report an error

  “PCI not applicable — PCI DSS/3DS is not applicable to Simpplr because we do not process or store credit card information.”

• Phi not stored Report an error

  “PHI — Simpplr does not store Personal Healthcare Information (PHI) or user medical information.”

• Privacy laws Report an error

  “GDPR (EU and UK) CCPA/CPRA (California) as well as the data privacy laws of other US states, including Virginia, Colorado, Utah, and Connecticut, among others. nFADP (Switzerland) Australian Privacy Act New Zealand Privacy Act PIPEDA (Canada) Quebec Privacy Act LGPD (Brazil) DPDP (India) PDPA (Singapore) APPI (Japan) PIPL (China)”

• DPA Report an error

  “Simpplr enters into DPA contracts with customers and subprocessors to ensure data security and privacy. Simpplr uses contractual means such as the EU or UK Standard Contractual Clauses (SCC) to ensure adequate protection.”

• Providers regions Report an error

  “Simpplr is hosted on Salesforce and Amazon Web Services (AWS) in the US and EU regions.”

• Deployment locations Report an error

  “The location of data processing varies at the designation of the customer. Customers can choose deployment locations that meet the data privacy laws and regulations of the US, EU, Switzerland, UK, Canada, Australia, New Zealand, Brazil, India, and other regions.”

• Pentesting Report an error

  “Simpplr engages external security vendors to provide application vulnerability and penetration testing quarterly. Testing is performed on Simpplr web and mobile applications on all platforms for which Simpplr products are available, which include Salesforce, AWS, iOS, and Android.”

• Encryption transit Report an error

  “All transmissions between a customer and Simpplr services are encrypted through Transport Layer Security (TLS 1.2) leveraging at least 2048-bit RSA server certificates and 256 or 128-bit symmetric encryption keys at a minimum. TLS 1.2 or higher is enforced.”

• Encryption rest Report an error

  “Simpplr provides data-at-rest encryption. Content, images, and attachments are encrypted with no additional hardware or software. The architecture leverages 256-bit AES symmetric keys to ensure strong protection.”

• SSO MFA Report an error

  “Customers are encouraged to bring their own identity provider and Simpplr supports several identity providers via SAML 2.0 and OAuth 2.0 to allow access to its application. MFA is supported when the Identity Provider has been configured as such. Role-Based Access Control (RBAC) helps with restricting user access to the application content and features on a need-to-know or need-to-access basis.”

• Dr rto rpo Report an error

  “Recovery Time Objective (RTO) = 24 hours (12 hours for some systems) Recovery Point Objective (RPO) = 4 hours”

• Dr replication Report an error

  “The service performs real-time database transaction journaling and file replication to disk at each data center, and near real-time data replication between geographically-disparate primary and secondary data centers. Between data centers, data is transmitted across encrypted links.”

• Customer access controls Report an error

  “Access to customer data requires explicit customer consent and is allowed only when necessary such as for support purposes. Any such Simpplr access requires multi-factor authentication (MFA), and all access is logged. No external party has access to Simpplr customer data at any time.”

• No sale Report an error

  “Data is never sold to third parties for marketing or revenue purposes.”

• No sensitive categories Report an error

  “Simpplr does not process or store any of the following categories of personal data: No sensitive personal data GDPR – No “special categories of data” CCPA/CPRA – No “sensitive personal information””

• No financial Report an error

  “No personal health information (PHI) No financial information”

• List Report an error

  “Please see the Simpplr support center website for the most recent list of Simpplr data subprocessor partners. You may subscribe on that page to be automatically notified when the list changes.”

• SOC 2 Report an error

  “Our subprocessors also hold SOC 2 Type 2 attestation certificates.”

• Government requests Report an error

  “Simpplr will only disclose customer data in response to a lawful request from a government agency in accordance with applicable law, our terms of service, and any applicable Data Protection Agreement (DPA).”

• Government request notice Report an error

  “Whenever possible, Simpplr will provide notice to customers when their data is being requested by a government. This notice will be provided in a timely manner and will include information about the nature of the request, the specific data being requested, and the agency making the request.”

• Incident response Report an error

  “The mission of the Simpplr Product Security Incident Response Team is to protect Simpplr and its customers from any real or suspected security concerns arising from the use of Simpplr applications and services.”

• Secure sdlc Report an error

  “Simpplr follows the most stringent and secure software development and quality standards including regular and frequent internal and external security tests. The software development lifecycle employs industry leading security tools for code and application analysis.”

• Vulnerability triage Report an error

  “Any vulnerability that is identified internally or reported by an external source is immediately triaged and the most appropriate remediation actions are applied.”

• Audit trail Report an error

  “Access to the application is logged and the application maintains a well defined audit trail for all security related activities.”

• Optional directory data Report an error

  “Customers may optionally choose to upload data such as title, department, user photo, or other fields. Customers have complete control over which fields they upload or allow their employees to edit.”

• Fda 21cfr11 Report an error

  “FDA 21 CFR Part 11 (US, Life Sciences/Pharmaceutical)”

• Ferpa Report an error

  “FERPA (US, Education)”

6 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Data Protection Officer Works council, private phones & privacy by design
• The Data Protection Officer Integration, identity & administration
• The Data Protection Officer European sovereignty
• The Frontline Operations Lead Works council, private phones & privacy by design
• The Frontline Operations Lead Integration, identity & administration
• The Frontline Operations Lead European sovereignty
• The Internal Communications Lead Integration, identity & administration
• The Internal Communications Lead European sovereignty
• The Microsoft 365 Administrator Integration, identity & administration
• The Microsoft 365 Administrator European sovereignty
• The Skeptic Integration, identity & administration
• The Skeptic European sovereignty
• The Works Council Member Works council, private phones & privacy by design
• The Works Council Member Integration, identity & administration
• The Works Council Member European sovereignty