Skip to main content
Trust & Security

Built to be trusted.
By design.

At Activation Studio, security, privacy, and reliability are core design principles — not afterthoughts. This page outlines how we protect your data and maintain compliance.

🛡️
ISO 27001:2022
Certified information security management
☁️
AppExchange verified
Security reviewed by Salesforce
🔒
Data stays in SFMC
Your contact data never leaves your org
🔐
AES-256 + TLS
Encryption at rest and in transit
🌍
GDPR & CCPA
Compliant data practices by design
⚡
99%+ uptime
Monitored continuously via Firebase
🛡️

Security

Data Security

  • ✓TLS encryption for data in transit
  • ✓AES-256 encryption for data at rest
  • ✓Monthly and recurring data protection audits
  • ✓Explicit customer consent before any temporary access to logging or database data
  • ✓User and role management with access disabled by default

Application Security

  • ✓OWASP ZAP testing
  • ✓SQL injection protection
  • ✓Cross-site scripting (XSS) protection
  • ✓Unauthorized access and authorization testing

Incident Response

  • ✓Automated logging and audit trails
  • ✓Regional incident identification and reporting
  • ✓Remediation and mitigation processes
  • ✓Admin user notification on incidents
🔒

Privacy

Privacy Policy

Review our full privacy practices for a comprehensive overview of how we collect, use, and protect your data.

Read Privacy Policy →

Data Usage

We use customer data to:

  • →Validate login requests
  • →Collect and process web behavior data

GDPR & CCPA compliance via:

  • ✓Regional hosting on request
  • ✓Dedicated security officer
  • ✓Regular privacy impact assessments
  • ✓Documented and enforced privacy policies
  • ✓Employee training and awareness
  • ✓Ongoing GDPR and CCPA audit monitoring

Data Retention & Deletion

Web data < 5 minutes
User sessions 30 minutes
Logging data 1 week
Database snapshots 1 week
📋

Compliance

Certifications

🛡️
ISO 27001:2022
Third-party audited & certified
Active

System Availability

Year 1 uptime 99.0% – 99.9%
Year 2 uptime 99.0% – 99.9%
DB backup frequency < 30 min
Monitoring Google Firebase

Security Best Practices

We recommend the following for your SFMC environment:

  • →Enforce MFA in Marketing Cloud
  • →Don’t share user accounts in Marketing Cloud
  • →Rotate Marketing Cloud passwords frequently
💬

Support & Contact

Security Contact

For questions or concerns about trust, security, or privacy — please reach out directly. We aim to respond within one business day.

Email security team →
FAQ

Security questions.

How is communication between business applications secured? +

Encryption in Transit:

  • ✓TLS 1.2 / TLS 1.3 for all communications, ensuring data confidentiality and integrity
  • ✓HTTPS with HSTS (HTTP Strict Transport Security) enforced to prevent downgrade attacks

Secure Front-End & Back-End Communication:

  • ✓API communications secured with OAuth 2.0 and JWT tokens for authentication
Are data leakage prevention (DLP) solutions applied? +

DLP measures on the hosting environment:

  • ✓At Rest: Data stored in Amazon RDS is encrypted
  • ✓In Transit: AWS Beanstalk environments configured to use HTTPS (TLS/SSL)
  • ✓Application Secrets stored in AWS Secrets Manager

Access Controls & Logging:

  • ✓Role-Based Access Control (RBAC) for confidential data
  • ✓Audit logs tracking data access and modifications
  • ✓Restricted database access via security groups

Encryption & Tokenization:

  • ✓AES-256 encryption protects stored data
Are backups performed and tested regularly? +
  • ✓Critical systems and databases backed up daily; cloud backups configured for continuous data protection (CDP)
  • ✓Backups are AES-256 encrypted to prevent unauthorized access
  • ✓Off-site backups via AWS S3 ensure redundancy
  • ✓Backups tested periodically; disaster recovery drills validate restoration effectiveness
Are patch management processes in place? +
  • ✓Security patches and software updates monitored and applied regularly via GitHub Dependabot
  • ✓AWS Beanstalk automatically manages infrastructure patches
  • ✓Security updates prioritised based on threat intelligence and CVE databases
  • ✓Software Bill of Materials (SBOM) tracks third-party libraries for vulnerabilities

Questions about security
or compliance?

We’re happy to answer procurement questions, share our ISO certificate, or walk through our security setup with your team.