Today, Wednesday, January 28, we celebrate Data Privacy Day, which marks the start of a week where we can expect to see thought-provoking content raising awareness around the topic of data privacy across various media platforms.

Overview

Privacy holds different meanings for individuals in various contexts, such as work, family, online interactions, and public spaces. U.S. State, U.S. Federal, industry, and international data regulations define privacy and its scope differently. This variability makes establishing a universal standard challenging, especially for developing data products and services.

However, the field of privacy is gaining recognition and becoming increasingly important. According to a survey conducted by PwC, 34% of companies are now using privacy as a growth enabler to launch new data-driven products. Privacy teams are gaining responsibilities beyond privacy, including AI governance, data ethics, platform liability, cybersecurity, and regulatory compliance. That expanded mandate is especially urgent for smaller companies. According to Network Right, 43% of cyberattacks specifically target small businesses, and 60% of those hit close permanently within six months.

What used to be a niche specialty has now gained recognition and importance. For example, the fact that universities are now offering privacy-focused courses that combine Computer Science, Business, and Law is a sign that this field is expanding beyond the legals of data regulation compliance and more into the practical application of privacy in products and services that are powered by personal data.

How we prioritize privacy and security in our products and services

At ActiveProspect, we deeply value privacy and security and we are constantly working to ensure they are a priority in all the products and services we provide.

The TrustedForm service helps website owners and customers document, analyze, or archive product or service registrations and the visitor interactions occurring around consent to contact notices, terms, and disclosures on webpages.

We help customers make more informed and compliant decisions about outreach to individuals who consent to be contacted by email, text message, phone call, or postal mail.

We do not sell personal data or use it for any purpose beyond the contracted processing, analysis, or transfer services. ActiveProspect does not sell website webform data or personal data to other parties. We are a service provider processing customer owned or customer directed data under contracted terms and on behalf of customers.

Data is used for lead generation processing, consent to contact transaction documentation, bot detection, and related data analysis use purposes only.

Check out our range of products, functions, and features designed to bring individual consumers and businesses enhanced transparency, responsible data processing, confidentiality, information security, and privacy-focused solutions.

Confidentiality and privacy in data use

• Data submitted to our LeadConduit, TrustedForm, and LeadsBridge platforms remains under client ownership, control, and direction. We do not sell personal data or use it for any purpose beyond the contracted processing, analysis, or transfer services.
• TrustedForm supports website domain ownership verification features.

Secure data retention and deletion

• We only retain client LeadConduit submitted “lead data” for 90 days, ensuring it’s available for processing, analysis, and decision-making before being marked for deletion.
• TrustedForm has defined data retention periods of 3 days and 90 days or up to 5 years for Retain product lead data. The latter retention period is for client compliance consent management and transaction purposes.
• LeadsBridge client “lead data” is generally not stored or retained after the source-to-destination data transfer confirmation. Some bridge configuration standards however do have a 90 day retention period defined to allow reasonable time for error correction,online backup, and restore functionality.

Privacy-compliant notices, choice, opt-in consent

• Our TrustedForm Verify tool assists business customers with compliance functions by analyzing webform language sources (first-party or third-party) for notice and consent language aiding compliance with consumer data privacy regulations like the US Telephone Consumer Protection Act (TCPA).
• TrustedForm consent capture can also function in mobile apps that support common Lead Ads standards. We believe Lead Ads are more transparent or provide consumers a clear choice and consent mechanism for the sharing of personal and contact information when interested in being contacted about a product or service in digital ad experiences.  

Limited data sourcing and collection

• TrustedForm’s Certify services only run on client webforms or partner mobile app Lead Ads forms.
• TrustedForm service is not a web browser cookie-based solution and is aligned with web browser depreciation of third-party browser cookies tracking.
• LeadConduit service supports lead source token authentication for API data exchange. It allows clients to only receive and analyze authorized lead sources.

Compliant data transfer mechanisms

• Our practices include adhering to cross-border EU-US Data Privacy Frameworks and employing encryption in transit for security.

Data masking and obfuscation

• We offer sensitive data field flagging features, such as LeadConduit Sensitive Data Fields Hashing and TrustedForm PII Masking.
• In a TrustedForm consent Session Replay, sensitive data fields can be flagged with ****** marks for visual reference. This feature ensures the data remains confidential, invisible, and unrecorded in TrustedForm.
• Some LeadsBridge services affiliated with social or digital advertising mask or obfuscate data fields in reporting to allow transaction validation while limiting PII identification.

Continuous security monitoring, alerting, auditing, and reporting 

• ActiveProspect attests to a series of security, availability, and confidentiality internal controls, continuously monitored and independently audited to our SOC2 controls report annually. If you would like to see our security controls and policy procedures, please view our Security and Trust Portal.
• Here you can find more information about our SOC2 and what it means.
• ActiveProspect also provides status and availability of our SaaS services on our Status page.
• ActiveProspect services are continuously monitored for security events and vulnerabilities. We perform routine security penetration testing on our SaaS platform services. Pen Tests involve independent security services and individuals who scan our application looking for weaknesses and ways to access the application or data. Findings are shared in a detailed report and we work to promptly address and resolve findings from the penetration tests.

In today’s digital environment, it’s crucial to align rigorous security and privacy measures, such as SOC2 audits and routine penetration testing, with proactive solutions to safeguard web-based systems. Techniques like web application security testing empower organizations to detect vulnerabilities, remediate weaknesses, and strengthen their protection of both personal data and transactional information throughout the software development lifecycle.

Data Subject Requests (DSRs)

• Even as a service provider, we have procedures to help support and fulfill client Data Subject Requests, including data deletion requests of client or partner controlled data. Any data subject request can reach our privacy office for review and actioning at privacy@activeprospect.com.

A strong commitment to privacy also in our core values

Privacy-focused elements are deeply embedded in many of ActiveProspect’s core values.

Leads ARE People

We understand that the leads we handle represent real individuals – people who could be our own friends and family. Unlike typical marketing companies that prioritize their own business interests over consumer privacy, we put the consumer first. We shape our strategy with this mindset and go to great lengths to safeguard the interests of these leads and the consumers themselves.

Transparency Drives Trust

ActiveProspect operates with complete transparency, believing that clarity fuels progress. As individuals and as an organization, we are upfront and fully transparent about our actions, leaving no room for hidden agendas.

Competence Creates Confidence

We believe in practicing what we preach. Our customers and teammates rely on us to be the leading experts in consent-based marketing. We achieve this by excelling in our field and sharing our knowledge with others. As lifelong learners, we understand the importance of staying humble and constantly expanding our knowledge.

Together is Better

To reach our destination, we set our sights on the collective goal. We foster collaboration, recognizing the power of joining forces for even greater achievements.

Conclusion

At ActiveProspect, we encourage open exploration and discussion “On Privacy and Technology.” We fully acknowledge the complex nature of meeting privacy requirements, and we’re determined to face this challenge head-on.

We’re thrilled about the journey ahead, which involves knowledge sharing, creative collaboration, and countless opportunities. By placing renewed emphasis on privacy considerations in our products and services, we aim to provide a secure environment for our clients, partners, consumers, and the wider community who rely on us as trustworthy guardians of their data.

Wishing you all a Happy Data Privacy Week!

The post Celebrating Data Privacy Week appeared first on ActiveProspect.

As the platform on a mission to make consent-based marketing the best method for customer acquisition, ActiveProspect is committed to meeting industry-recognized security standards for the benefit of our customers and the protection of their data. 

That’s why we’re excited to announce we have successfully completed our SOC 2 Type II Audit for the Trust Services Criteria of Security, Confidentiality, and Availability!

What does SOC 2 mean?

SOC stands for Service Organization Controls (SOC). This comprehensive Trust Services Criteria framework was developed by the American Institute of Certified Public Accountants (AICPA) and the Information Systems Audit & Control Association (ISACA) to better assess the growing shared reliance on IT technical controls performed by service organizations. 

According to the AICPA and ISACA, these reports are intended to meet the needs of a broad range of users who need detailed information and assurance about the controls at a service organization relevant to the security, availability, and processing integrity of the systems the service organization uses to process users’ data, as well as the confidentiality and privacy of the information processed by these systems.

A SOC 2 audit is completely voluntary, meaning that businesses that choose to undergo this lengthy and tedious process do so to build the ultimate level of trust and confidence with their customers and prospects through this security compliance framework. It’s similar to the reason that businesses choose to become ISO 27001 compliant, in that adhering to any of these recognized, security-focused standards will set you above less prepared competitors.

What is a SOC 2 Type II report?

A SOC 2 Type II report is the result of an AICPA / ISACA framework that aims to provide an independent evaluation of a service organization’s performance of key trust services criteria controls related to security, availability, processing integrity, confidentiality, and privacy.  

It includes a detailed description of the service organization’s environment, applications, services, controls, independent auditor’s tests, observations, and an overall opinion on the design and operational effectiveness of those controls.

What does our SOC 2 Type II report mean for you?

This SOC 2 Type II Audit demonstrates our commitment to an independent evaluation of ActiveProspect’s policy, procedures, and controls relating to the trust services criteria of security and availability in our important role as a Service Organization for our clients. Completion of this SOC 2 Audit and the ongoing annual commitment to annual independent assessment show that ActiveProspect is focused on and fully committed to the secure handling and processing of our clients’ and partners’ data.  

How do I know ActiveProspect will continue to remain SOC 2 compliant?

As technology and security practices continue to evolve at a rapid pace, SOC 2 audits are conducted annually. Our security, compliance, product development, DevOps, and engineering teams are committed to ongoing monitoring, reviews of our platform, and enforcement of our policies and procedures. If you still have questions, please don’t hesitate to contact us.

The post ActiveProspect’s SOC 2 audit report & what it means for you appeared first on ActiveProspect.

ActiveProspect Meets Security, Availability and Confidentiality Trust Services Criteria Set By The American Institute Of Certified Public Accountants (AICPA) and Information Systems Audit and Control Association (ISACA).

AUSTIN, TEXAS, October 4, 2024 — ActiveProspect, the SaaS platform for consent-based marketing, announces it has successfully completed its System and Organization Controls (SOC 2®) examination.

The results of the audit, reviewing a control period of 12 months, confirm that ActiveProspect’s information security practices, policies, procedures, and operations meet the SOC 2 standards for security, availability and confidentiality in the SaaS space.

This SOC 2 Type II report is conducted by independent Information Technology control auditors following the AICPA and ISACA guidelines for audit of controls at service organizations focused on security, availability and confidentiality.

According to the AICPA, these reports are intended to meet the needs of a broad range of users providing detailed information and assurance about the controls at a service organization relevant to security, availability, confidentiality, and processing integrity of the systems the service organization uses to process user and client data.

The annual SOC 2 audit and report demonstrates ActiveProspect’s commitment to a continuous monitoring environment and the performance of responsible actions to support IT Security Controls, Policies, Processes and Procedures covering all of our SaaS Products and Services,” says Benjamin Farrar, ActiveProspect Director of Privacy, Security, & Compliance. “Over 120 applicable trust service criteria, control activities, and service auditor tests were considered during the review.”

We also will continue to update our ActiveProspect Security & Trust Portal, where clients and interested parties can see our universe of control categories, descriptions, policy information, and request documentation, including our SOC 2 report, recent penetration test information, and cyber insurance evidence.

“We are proud to once again demonstrate our unwavering commitment to the security of our customers’ data and the reliability of our platform through our fourth successful SOC 2 Type II audit,” says Alex Wolfe, ActiveProspect’s Chief Technology Officer. “Since opening our doors in 2004, earning and maintaining the trust of our customers has always been a top priority. Passing the SOC2 Security, Availability, and Confidentiality Trust Services Criteria controls with zero exceptions underscores the maturity and resilience of our security program and systems. As we continue to grow, we remain dedicated to delivering an annual audit report that independently validates the ongoing strength of our controls and processes.”

About ActiveProspect

ActiveProspect is on a mission to make consent-based marketing the best channel for online customer acquisition. We provide marketers the products they need to acquire qualified customers at scale. Our platform is trusted by thousands of companies engaged in direct-to-consumer marketing, helping them save wasted spend, comply with ever-changing regulations, and manage a constantly evolving partner landscape.

Our flagship product, TrustedForm is used to certify over 1 billion opt-in digital customer leads every year and is the gold standard for documenting prior express written consent for TCPA compliance.

The post ActiveProspect successfully completes SOC 2 Type II security audit appeared first on ActiveProspect.

As the platform on a mission to make consent-based marketing the best method for customer acquisition, our team at ActiveProspect is committed to meeting industry recognized  security standards for the benefit of our customers and the protection of their data. 

That’s why we’re thrilled to announce we have successfully completed our SOC2 Type II  Audit for the Trust Services Criteria of Security and Availability!

If you’re wondering what exactly SOC2 stands for, and more importantly, what it means for clients that trust ActiveProspect to protect their business data, keep reading to find the answers to all your questions.

What does SOC2 mean?

SOC stands for Service Organization Controls (SOC). This comprehensive Trust Services Criteria framework  was developed by the American Institute of Certified Public Accountants (AICPA) and the Information Systems Audit & Control Association (ISACA), to better assess the growing shared reliance of IT technical controls performed by service organizations. 

According to the AICPA and ISACA, these reports are intended to meet the needs of a broad range of users that need detailed information and assurance about the controls at a service organization relevant to security, availability, and processing integrity of the systems the service organization uses to process users’ data, and the confidentiality and privacy of the information processed by these systems.

A SOC2 audit is completely voluntary, meaning that businesses who choose to undergo this lengthy and tedious process do so to build the ultimate level of trust and confidence with their customers and prospects through this security compliance framework.

What is a SOC2 Type II report?

A SOC2 Type II report is the result of an AICPA / ISACA framework which aims to provide an independent evaluation of a service organization’s performance of key trust services criteria controls related to security, availability, processing integrity, confidentiality and privacy.  

It includes a detailed description of the service organization’s environmental, applications, services, controls, independent auditor’s tests, observations, and an overall opinion on the design and operational effectiveness of those controls.

What does our  SOC2 Type II report mean for you?

This SOC2 Type II Audit demonstrates our commitment to independent evaluation of ActiveProspect’s policy, procedures and controls relating to the trust services criteria of security and availability in our important role as a Service Organization for our clients.  Completion of our first SOC2 Audit and the ongoing annual commitment to annual independent assessment shows that ActiveProspect is focused on and fully committed to secure handling and processing of our clients and partners data. 

How do I know ActiveProspect will continue to remain SOC2 compliant?

SOC2 audits are conducted annually, as technology and security practices continue to evolve at a rapid pace. Our security, compliance, product development, devops, and engineering teams are committed to ongoing monitoring, reviews of our platform and enforcement of our policies and procedures.

If you still have questions, please don’t hesitate to reach out and contact us here.

The post Our SOC2 Audit Report & What It Means For You appeared first on ActiveProspect.