Snapshot 185801
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to main content This page describes the technical and organizational measures and controls maintained by Retool to protect the confidentiality and security of Customer Data in its provision of the Retool cloud services. Unless otherwise stated, capitalized terms used in this page will have the meanings given to them in the Agreement. Access Controls Access to Customer Data by Retool personnel: Is restricted on a need-to-know basis in accordance with least-privilege principles; Requires unique user credentials and two-factor authentication; Is subject to technical controls and audit policies designed to log such access; and Is reviewed periodically to confirm access remains appropriate, and is revoked when no longer required. Retool Personnel Controls Retool maintains policies and practices for its personnel who have access to Customer Data, including: Conducting pre-employment background checks, to the extent permitted under applicable laws; Requiring ongoing privacy and security training; and Requiring acknowledgement of Retool’s information security policy covering the security, availability, and confidentiality of the Retool services. Systems and Network Security Retool maintains network security measures, including network segmentation, firewalls configured in accordance with industry standard practices, including: Encrypting Customer Data in-transit between Customer’s network and the Retool services using industry standard encryption methods and supported secure cipher suites and protocols. Encrypting Customer Data at-rest using industry standard encryption methods. Periodically reviewing cryptographic standards and updating selected technologies and cipher suites based on assessed risk and market acceptance of new standards. Encrypting company laptops with full disk encryption and enforcing screen lock-outs. System Monitoring and Vulnerability Management Retool employs measures to regularly monitor its production environment for unauthorized intrusions, vulnerabilities, and similar risks, including: Automating vulnerability and malware scanning of production hosts and personnel laptops and workstations, with triage and remediation of findings based on assessed risk and severity. Conducting regular review, testing, and installation of security updates and patches. Maintaining a centralized logging environment, with logs analyzed for security events by automated monitoring software overseen by Retool’s security team. Monitoring and alerting of the Retool-hosted cloud environment for suspicious or known malicious activity. Annual penetration testing conducted by independent third parties. Operating a vulnerability disclosure program through which security researchers may report potential vulnerabilities in the Retool services. Change Management and Secure Development Retool maintains change management policies and procedures for software, system, and configuration changes, including a process for testing and approving the promotion of changes into production and for performing security review of significant changes. Retool follows secure development practices aligned to industry standard practices, including automated static code analysis and peer review of code prior to deployment to production. Incident Management Retool maintains security incident management policies and procedures, including an incident response plan for responding to any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, data (“Security Breach”). Retool will notify impacted customers without undue delay of any confirmed Security Breach, to the extent permitted by law. Backups, Business Continuity, and Disaster Recovery Retool maintains policies, controls, and practices for business continuity and disaster recovery purposes, including: Industry standard practices for redundancy and fault tolerance designed to maintain the availability of the Retool services. Policies and procedures for performing backups of Customer Data, and stores backups redundantly within its hosting provider’s data centers. A business continuity and disaster recovery plan, which is tested on an annual basis, designed to minimize disruption to the Retool services. Audit Reports and Certifications Retool engages independent third parties to conduct reviews of Retool’s security practices against recognized audit standards, such as SOC 2 Type II and ISO 27001 certification audits. Audit reports will be made available at Retool’s Trust Center. Access Controls Retool Personnel Controls Systems and Network Security System Monitoring and Vulnerability Management Change Management and Secure Development Incident Management Backups, Business Continuity, and Disaster Recovery Audit Reports and Certifications Was this page helpful?