KickoffLabs LLC Security Measures

Last Updated: November 30, 2020

KickoffLabs takes data security and privacy very seriously. If you are reading this then we know it’s probably important to you too. While we don’t like to expose too much detail around our practices (as it can empower the very people we are protecting ourselves against), we have provided some general information below to give you confidence in how we secure the data entrusted to us.

What YOU can do to help

Most online security breaches aren’t technical in nature. They come from human mistakes like weak passwords or willingness to give out too much personal information.

• Use a strong password and change often. We encourage you to help us by also taking precautions to protect your personal data when you use the Services. Change your account password often, using a combination of letters, numbers, and characters, and make sure you use a secure connection.
• If you are done with a customer list… delete the campaign and we’ll delete the data on our side as well. The less customer data you have lying around. The better.
• Don’t email customer lists that aren’t password protected documents. If you download a list from our server we strong suggest that you encrypt it with a password before emailing it around.
• Only grant trusted individuals account access and limit their access using our management tool to only the campaigns and functionality required for their role.

Application Level Security

• KickoffLabs account passwords are hashed. Our own staff can’t even view them. If you lose your password, it can’t be retrieved—it must be reset.
• All login pages (from our website and mobile website) pass data via TLS.
• Access to the entire application is encrypted with TLS.
• Login pages have brute force protection.

Protection from Data Loss, Corruption

• All databases are kept separate and dedicated to preventing corruption and overlap. We have multiple layers of logic that segregate user accounts from each other.
• Account data is mirrored and regularly backed up off site.

Data Center Security

Our application data is managed by systems hosted on top of Amazon Web Services. You can learn, in detail, about the security measures they take to secure the physical data centers here: https://aws.amazon.com/security/

Internal Protocol and Data Insurance

• We train employees on best security practices, including how to identify social engineering, phishing scams, and hackers.
• In order to protect our company from a variety of different losses, KickoffLabs has established a comprehensive insurance program. Coverage includes, but is not exclusive to: coverage for cyber incidents, data privacy incidents (including regulatory expenses), general error and omission liability coverage, excess cyber liability coverage, property and business interruption coverage, as well as international commercial general liability coverage.
• Founder approval is required to access any customer data at KickoffLabs. No one will ever ask for additional PII from you or request your account password.

Protecting Ourselves Against You

Knowing that the biggest security hole in most systems is at the human, individual account, level our goal is also to help protect you from yourself and potential bad actors on your own teams.

• We monitor and will automatically suspend accounts for signs of irregular or suspicious login activity. Certain changes to your account, such as to your password, will trigger email notifications to the account owner.
• We monitor accounts and campaign activity for signs of abuse.
• In addition to our scalable algorithms, we employ another layer of human reviewers, who monitor for anomalous account and email activity.
• We provide the ability to establish tiered-levels of access within accounts.
• We send notifications of password changes to account owners.
• When you change passwords you will be logged out on any other devices on which your account had been logged in.

Limiting Data Storage

If everything else fails our goal is to reduce risk. We do this partially by not keeping data around that’s not needed anymore.

• Data Pruning – While we follow best practices to protect our databases that contain PII we also make sure to regularly delete data. When you delete an account… we queue all the data to be deleted… including customer lists you’ve collected. When you delete a campaign on your account we do the same thing.
• Paused Accounts for Data Storage – In fact, in order for us to keep the data collected we require a paid account with a nominal monthly fee after the free trial period. This ensures you are always aware we may still be storing data as long as you have your account and are OK with the data being deleted when the account is. The danger of allowing you to keep a free account is that it’s impossible to know when it’s OK to delete the data we’ve collected. So we don’t run that risk.
• We only store analytics data for the most recent 12 months on your campaigns.

Privacy Protections

• We work with a legal team that specializes in online software, compliance, and international/state level privacy and security policies.
• We undergo annual verification with a U.S. based third party-outside compliance reviewer under the Privacy Shield verification program, and we have certified our compliance with the EU-U.S./Swiss-U.S. Privacy Shield Frameworks. You can view our status here: https://www.privacyshield.gov/participant?id=a2zt00000008UF5AAM&status=Active
• We are members of the BBB and BBB EU programs and retain them for any required arbitration purposes.

Responsible Disclosure

If you’ve discovered a vulnerability in the KickoffLabs application, please don’t share it publicly. Instead, please submit a report to us via the process outlined below. We review all security concerns brought to our attention, and we take a proactive approach to emerging security issues. There are always new security threats online and we work to stay on top of the latest attacks. We appreciate the community’s efforts in creating a more secure web.

If you believe your account has been compromised or you are seeing suspicious activity on your account please email support@kickofflabs.com