Data privacy and information security

Data privacy and information security at Culture Amp

At Culture Amp, we are committed to our customers’ data privacy and information security. We’ve aligned our security programs with ISO 27001, followed secure development practices, provided ongoing training for employees, and more. Recently, we’ve also reviewed our policies and procedures to make sure we are compliant with The General Data Protection Regulation (GDPR).

The GDPR is the new EU data protection regulation, that aims to give EU citizens more control over how organizations collect and process their data, and standardize data protection policies across the EU. This regulation is applicable starting May 25, 2018.

Any company holding or processing information of EU citizens is impacted by GDPR regardless of its location, and is required to comply with the new regulation.

Our teams have reviewed our data privacy policies and updated our security procedures. We’ve also worked with internationally recognized privacy experts to build a global privacy framework to comply with the GDPR and other regulations. Here are the main updates we’ve made:

Platform and procedures

To ensure Culture Amp is compliant with the latest regulations, we’ve:

reviewed our internal security procedures and updated our internal policies for Data Protection, Cryptography, Secure Development, and Secure Engineering.
extended our internal security training to include an even broader scope of privacy and security materials to meet the GDPR Privacy by Design obligations.
reviewed our third party data sub processors to ensure end-to-end compliance.
reviewed and amended our data retention policies to meet the new individual rights under GDPR, including Right to be Forgotten and Right to Access obligations, and updated the relevant processes.
reviewed and improved our user experience to make it even easier for individuals using the platform to understand how their data is collected and used.

Legal documentation

The Culture Amp legal team has been working to ensure our documentations are updated to reflect the GDPR requirements and ensure Culture Amp’s compliance:

Our Privacy Policy has been updated to meet the requirements of GDPR and make it easier for individuals to understand how their data will be collected and used.
Our Data Protection Agreement (DPA) has also been updated to comply with GDPR obligations, and to provide adequate protections for international data transfers outside the EU. Contact us to get the updated version of Culture Amp’s DPA

International data transfers

To ensure GDPR compliance for international data transfers, Culture Amp will continue to use mechanisms such as the Standard Contractual Clauses in our DPA and the EU-U.S. Privacy Shield. These mechanisms allow companies around the world to comply with EU data protection requirements when transferring personal data from and to the EU.

Culture Amp’s continuous commitment to  information security

To learn faster through feedback, we know customers and their employees must trust us with their data, which is why we take information security and data privacy very seriously.

Here’s a look at what Culture Amp’s security experts have been working on:

ISO 27001 certified

We’ve aligned our security program with ISO 27001.

GDPR compliance

We have been working with internationally recognized external privacy consultants in preparation for GDPR compliance.

Vulnerability management

Daily vulnerability scanning is performed on all Culture Amp production systems.

External security audit

Culture Amp regularly undergoes penetration tests and code reviews by expert security consultants.

Organizational security

Dedicated staff is responsible for risk management and information security. We also conduct background checks on all our employees.

Application security

Access to the Culture Amp platform is authenticated using customer’s SAML compliant federated identity provider, Google integration or passwords which are hashed with bcrypt algorithm.

Data protection

Full disk encryption is enabled for all systems containing customer data, backups are encrypted using AES256 symmetric encryption algorithm.

Network security

Our production environment is fully segregated from corporate, development and test environments. We use Next Gen WAF and RASP technology to protect the Culture Amp Platform.

Build a world-class employee experience today

Watch a 3-minute demo

Speak to our team

Data privacy and information security