The following description reviews the technical and organizational measures implemented by Zesty as the Data Importer to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

Zesty’s Platform is built on Amazon Web Services (AWS) and based on a serverless architecture.

This allows Zesty to operate without managing traditional servers and databases. Zesty does not host or run its own routers, load balancers, DNS servers, or physical servers.

The security objectives of Zesty are identified and managed to maintain a high level of security and consists of the following (concerning all data assets and systems):

• Availability – information and associated assets should be accessible to authorized users when required. The computer network must be resilient. Zesty will detect and respond rapidly to incidents (such as viruses and other malware) that threaten the continued availability of assets, systems, and information.
• Confidentiality – ensuring that information is only accessible to those authorized to access it, on a need-to-know-basis.
• Integrity – safeguarding the accuracy and completeness of information and processing methods and therefore requires preventing deliberate or accidental, partial or complete, destruction, or unauthorized modification, of electronic data.

Description of the technical and organizational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons:

System Control

Access to the Zesty’s database is highly restricted in order to ensure that only the relevant personnel who have received prior approval can access the database. Zesty’s has also implemented appropriate safeguards related to remote access and wireless computing capabilities. Employees are required to choose unique and complex passwords that allow strict access or use to Personal Data, all in accordance with such employee’s position, and solely to the extent such access or use is required. There is constant monitoring of access to the Personal Data and the passwords used to gain access. Zesty is using automated tools to identify non-human login attempts and rate-limiting login attempts to minimize the risk of a brute force attack, in addition multi-factor authentication is enforced

Data Access Control

User authentication measures have been put in place in order to ensure that access to Personal Data is restricted solely to those employees who have been given permission to access it and to ensure that the Personal Data is not accessed, modified, copied, used, transferred or deleted without specific authorization for such actions to be done. Any access to Personal Data, as well as any action performed involving the use of Personal Data requires a password and a second authentication factor, as well as blocked when applicable. Each employee is able to perform actions solely in accordance with the permissions granted to him by Zesty. Furthermore, Zesty conducts ongoing reviews of the employees who have been given authorization to access Personal Data, in order to assess whether such access is still required. Zesty revokes access to Personal Data immediately upon termination of employment.

Physical Access Control

Zesty recognizes the significance of physical security controls as a key component in its overall security program. Physical access methods, procedures and controls have been implemented to help prevent unauthorized access to data, assets and restricted areas. Processes are in place to remove access to physical resources when an individual no longer requires access. Physical Access to Zesty office does not provide any privileges to the production environment.

Zesty’s physical infrastructure is hosted on Amazon’s data centers and utilizes the AWS technologies. Amazon’s data center operations have been accredited under ISO 27001; SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II); PCI Level 1; FedRAMP; and Sarbanes-Oxley (SOX).

For more information on Amazon certification, please see link here.

Organizational and Operational Security

Zesty puts a lot of effort and invests a lot of resources into ensuring that Zesty’s security policies and practices are being complied with, including by continuously providing employees with training with respect to such security policies and practices. Zesty strives to raise awareness regarding the risks involved in the processing of Personal Data. In addition, Zesty has implemented applicable safeguards for its hardware and software, including by installing firewalls and anti-virus software on applicable Zesty hardware and software, in order to protect against malicious software.

Availability Control

Zesty maintains backup policies and associated measures. Such backup policies include permanent monitoring of operational parameters as relevant to the backup operations. Furthermore, Zesty’s cloud deployment includes an automated backup procedure. Zesty ensures that regular checks are carried out to determine whether it is possible to recover from the backup, as required and applicable.

Penetration Testing

External penetration test is performed on an annual basis. The penetration tests include, among others, procedures to prevent customers, groups of individuals, or other entities from accessing confidential information other than their own. The penetration tests and security scans are performed by a reputable third-party vendor. In addition, Zesty conducts vulnerability scans designed to identify potential vulnerabilities or misconfigurations on a periodic basis and after any significant change in the environment. Actions are taken to remediate identified deficiencies on a timely basis. Vulnerability scans are performed using external tools, in order to detect potential security breaches

Encryption

Zesty implements Encryption at rest of customer data as well as encryption in transit of all communication between Customer and service, as well as communication on and to the services. Zesty uses TLS encryption on our web assets to ensure the highest security and data protection standards. We regularly verify our security certificates and encryption algorithms to keep customer data safe.

At-rest user data is encrypted. Learn more about Server-Side Encryption with Amazon S3-Managed Encryption Keys.

Zesty does not store any private keys, passwords, or authentication tokens. The authentication is made based on the AWS Identity and Access Management (IAM) Cross Account role along with Google Workspace ID that provides a two-factor authentication.

Compliance and Certification

Zesty operations, policies and procedures are audited regularly to ensure Zesty meets all the Service Organization Control (SOC2) standards expected as a SaaS platform. Compliance certifications and attestations are assessed by a third-party, independent auditor and result in a certification, audit report, or attestation of compliance. Zesty’s systems and Services were audited and verified by such SOC2 compliance certification. Zesty is SOC2 certified.

Such certifications and audits are meant to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons are according to the System and Organization Controls 2 (SOC2) industry standard. Upon Customer request and subject to Customer’s confidentiality undertaking Zesty shall provide with the Customer with the SOC2 reports.

For more information regarding the SOC2, please see our SOC2 webpage in our blog here.

Additional Safeguards implemented by Zesty for Customer Data Transfers to the US:

Measures and assurances regarding U.S. government surveillance have been implemented by Zesty, and Zesty agrees and hereby represents it maintains the following additional safeguards:

1. Zesty maintains industry standard measures to protect the Personal Data from interception (including in transit from Customer to Zesty and between different systems and services). This includes maintaining encryption in transit and at rest.
2. As of the Effective Date stated above, Zesty has not received any national security orders.
3. No court has found Zesty to be the type of entity eligible to receive directives issued under section 702 of the United States Foreign Intelligence Surveillance Court (“FISA”) as (i) an “electronic communication service provider” within the meaning of 50 U.S.C § 1881(b)(4) or (ii) a member of any of the categories of entities described within that definition.
4. In the event that FISA applies to Zesty, Zesty will make reasonable efforts to resist, subject to applicable laws, any request for bulk surveillance relating to the Personal Data in compliance with applicable laws.
5. If Zesty becomes aware of any law enforcement agency or other governmental authority (“Authority”) attempt or demand to gain access to or receive a copy of the Personal Data (or part thereof), whether on a voluntary or a mandatory basis, then, unless legally prohibited or under a mandatory legal compulsion that requires otherwise, Zesty shall: (i) inform the relevant Authority that Zesty is a Processor of the Personal Data and that Customer, as the Controller has not authorized Zesty to disclose the Personal Data to the Authority; (ii) inform the relevant Authority that any and all requests or demands for access to the Personal Data should be directed to or served upon Customer in writing; and (iii) use reasonable legal mechanisms to challenge any such demand for access to Personal Data which is under the Zesty’s control.
6. Notwithstanding the above, if, taking into account the nature, scope, context and purposes of the related Authority’s intended access to Personal Data, Zesty has a reasonable and good-faith belief that urgent access is necessary to prevent an imminent risk of serious harm to any individual or entity, these subsections shall not apply. In such event, Zesty shall notify Customer, as soon as possible, following the access by the Authority, and provide Customer with relevant details, unless and to the extent legally prohibited to do so.
7. Zesty will inform Customer, upon written request (and not more than once a year), of the types of binding legal demands for Customer Data Zesty has received and complied with, including demands under national security orders and directives, specifically including any process under Section 702 of FISA.