Company / Security
Security is a practice, not a page.
The platform uses encryption, unique content links, password controls, continuous testing, granular permissions, and resilient infrastructure.
- 2048 bit
- RSA for sensitive metadata
- AES
- Per file encryption keys
- 10 to the 30
- Possible URL combinations
- Continuous
- Security testing
Encryption
Protecting data in transit and at rest.
Go Digital Science transmits login, passwords, tokens, and other sensitive metadata using 2048 bit RSA keys from the SSL certificate provider. Stored collateral is encrypted with the Advanced Encryption Standard, or AES, using a unique key for each item.
Most providers use 3DES, which is still strong, but NIST recommends AES, the standard used by the US Government. Customers can also ask their account executive or account manager to enable SSL for all communication.
Unique URLs
Email pitches use a unique 20 digit URL schema, with a very large combination space. The intent is simple: the content reaches the intended audience and only the intended audience. For comparison, the original page noted the odds of being struck by lightning, winning an Olympic medal, or becoming an astronaut. A number of this size is not practical to crack.
Advanced password features
An optional password enhancement can be enabled by an account executive or account manager. When enabled, each user must change the password every 90 days, cannot reuse any of the previous six passwords, must use at least eight complex characters, and cannot change the password more than once per day. A visual strength indicator helps users create stronger passwords.
Ongoing testing
Security is an evolving target.
A site that is not constantly checking for new risks will eventually meet one it cannot handle. Go Digital Science uses weekly vulnerability scanning, always on application security testing, frequent penetration testing, and static code analysis.
The testing looks for the most common categories of threat identified by the OWASP Top Ten and the Web Application Security Consortium Top 25. When a risk is identified, mitigation begins immediately and the fix follows the software development lifecycle.
Access and availability
Control where control is needed.
Using existing users, groups, and roles such as Admin and Group Admin, customers can set discrete permissions for content, tags, analytics, and other parts of the platform. The goal is the right balance of control and authorization without making the product complicated.
The platform works with three top data center providers and includes distributed denial of service protection, so availability remains a core operating requirement.
Certifications and standards
The record from the original company.
SOC 2
Conformity of Service Organization Control 2 completed in September 2013.
TRUSTe
U.S. and EU Safe Harbor status earned in December 2013.
NIST guidance
AES selected for stored content, consistent with NIST recommendation.
OWASP and WASC
Testing aligned to common threat categories and the WASC Top 25.
Security review
Bring your questions to the team.
We can walk through the controls, the testing, and the enterprise requirements that matter to you.