# Security at Simple Poll

The plain-text version of https://simplepoll.rocks/security/, with the security and privacy facts from the rest of simplepoll.rocks, each linked to where it's published. Questions about security: security@simplepoll.rocks.

## At a glance

| | |
|---|---|
| Certification | ISO 27001 (Simple Poll is fully certified against the requirements of the international ISO 27001 standard). Certificate: https://cvs.babcert.com/babcert.asp?c=224799&v=ln89uay111 |
| Hosting | Amazon Web Services (AWS), located within the United States |
| Hosting provider's accreditations | Amazon's data center operations are accredited under ISO 27001; SOC 1 and SOC 2/SSAE 16/ISAE 3402 (previously SAS 70 Type II); PCI Level 1; FISMA Moderate; Sarbanes-Oxley (SOX) |
| Where data is stored | Personal information is stored and processed in the United States and United Kingdom, or where Simple Poll or its partners, affiliates and third-party providers maintain facilities (privacy policy) |
| Encryption | In transit (SSL/TLS on all connections) and at rest (Amazon RDS encryption) |
| Sign-in | Mandatory single sign-on with your Slack login for the dashboard; no passwords |
| What Simple Poll can see in Slack | The polls and votes your team creates: no channel history, no files, no DMs |
| GDPR | UK company, registered with the UK Information Commissioner's Office (ICO, registration ZA556272), fully compliant with the GDPR; DPA available on Enterprise |
| Penetration testing | Regular, comprehensive external penetration tests |
| Bug bounty | Public program on HackerOne: https://hackerone.com/simple_poll/ |
| Payments | Stripe processes all financial information, PCI compliant |
| Security reviews | Security reviews & questionnaires, DPA and MSA on the Enterprise plan: sales@simplepoll.rocks |

## Security

**ISO 27001.** We are fully certified against the requirements of the international ISO 27001 standard. Learn more: https://blog.simplepoll.rocks/iso-27001-certification/. Official certification: https://cvs.babcert.com/babcert.asp?c=224799&v=ln89uay111.

**Subprocessors.** We work with a range of sub-processors to deliver our services to you. The list, what each provides and where: https://simplepoll.rocks/sub-processors/.

**Bug Bounty Program.** We've invited the security research community to help increase the security of our family of products and services: https://hackerone.com/simple_poll/.

**Penetration Testing.** We regularly undergo comprehensive external penetration testing of our systems and applications to find any potential security vulnerabilities.

**Backups & Redundancy.** Our data is regularly backed up with tested backup procedures and protected from a range of security threats or natural disasters.

**Internal Practices.** In addition to those set out here, we have a number of internal security practises that are regularly updated and audited including cyber-security awareness training for all employees. These practices are incorporated within our comprehensive information security management system, part of ISO 27001.

**Cloud Service Provider.** Our backend server is hosted on Amazon Web Services (AWS) and is protected with a range of redundancy, data protection and recovery measures. Amazon's data center operations have been accredited under:

- ISO 27001
- SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II)
- PCI Level 1
- FISMA Moderate
- Sarbanes-Oxley (SOX)

## Privacy

**GDPR.** As a company registered in London, UK and with customers across Europe, we're committed to and are fully compliant with the requirements set out in the General Data Protection Regulation (GDPR) that came into effect across EU member states on the 25th May 2018. How we handle GDPR: https://simplepoll.rocks/gdpr/.

**Privacy Policy.** We have a dedicated privacy policy that details how we collect, use and protect the data that's shared with us across our websites and Slack apps: https://simplepoll.rocks/privacy-policy/.

**Encryption.** Data shared with us is encrypted both in transit and at rest. We use Amazon's RDS database product to encrypt data at rest and all our connections use SSL/TLS for encryption in transit.

**Permission Scopes.** As part of the installation process of Simple Poll and our family of applications, you'll be asked to agree to a number of permissions required for the app to function correctly. Every scope and what it's for: https://simplepoll.rocks/scopes/.

**PCI Compliance.** Our payment provider Stripe handles the secure protection and processing of all financial information in a fully PCI compliant manner: https://stripe.com/docs/security/stripe/.

**SSO with Slack.** All authentications to our dashboard are secured with mandatory Single-Sign-On using your Slack login, no passwords are required.

## Enterprise

From https://simplepoll.rocks/ and https://simplepoll.rocks/pricing/:

- ISO 27001 certified: information security independently audited and certified.
- Can't read your messages: Simple Poll sees the polls and votes your team creates: no channel history, no files, no DMs.
- Built for Grid: org-wide coverage on Slack Enterprise Grid, with every Premium feature included, the API too.
- GDPR compliant: UK company, ICO-registered, with a DPA available on Enterprise.
- Procurement friendly: annual invoicing with POs and bank transfer, a signed DPA and MSA, and completed security questionnaires.
- Security reviews & questionnaires, MSA, and centralized billing with PO & invoice payment are on the Enterprise plan. Contact sales@simplepoll.rocks.

## Contacts

- Security: security@simplepoll.rocks
- Data protection: privacy@klopp.industries (Klopp Industries Ltd Data Protection Contact: Wilhelm Klopp)
- Sales and Enterprise: sales@simplepoll.rocks
- Support: support@simplepoll.rocks

## More

- Pricing: https://simplepoll.rocks/pricing.md
- Who makes Simple Poll: https://simplepoll.rocks/about.md
- Sub-processors: https://simplepoll.rocks/sub-processors/
- Terms of Service: https://simplepoll.rocks/terms/