Taskfeed Security, Privacy and Architecture Overview
Security, Privacy and Architecture
We would like to make two things clear. First, we respect your privacy and take significant efforts to protect all your data. Second, we would never do anything with your data that we wouldn’t be proud to tell the world about.
We are responsible for ensuring the privacy, confidentiality, integrity, and availability of data in our trust. This responsibility includes that of customer data processed by our products and stored on our systems. We have an obligation to provide appropriate protection against threats and to provide a level of service to our customers.
This document outlines the controls (both technical and organisational) we have put in place for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Data), confidentiality and integrity of Customer Data.
As you continue to learn more about Taskfeed we recommend you also review our Terms of Service and Privacy Policy.
Information Security
We have implemented an information security management system based on ISO 27001:2013. This management system encompasses the use of numerous policies covering the use of vendors and third party services, passwords, secure engineering, clear desks and screens, and acceptable use policies.
Our access to your data
None of the data submitted to Taskfeed including Boards, Tasks or customer information from your CRM is shared with us. This information resides within your Salesforce instance which is inaccessible by default. This is something rather unique about how we operate. As our access to your Salesforce environment including configuration and data it means unless expressly granted we do not have a means of accessing your data.
We will collect personal data relating to Users for the provision of support and for the purpose of product analytics. If you provide your customers, partners or any third party access to Taskfeed through Salesforce Communities the we will treat those individuals as Users and collect data for them also.
In the course of providing support it may be necessary to temporarily grant access to your Salesforce environment. Temporary access is possible through a Salesforce feature called “Grant Login Access”. This mechanism provides an auditable time restricted access to your environment. Only specific members of the team with sufficient training are permitted to login to your environment using this method. We will always request login access along with a reason why access is required, how long access is required and an outline for any actions we will perform with the access. Use of “Grant Login Access” is at the discretion of the subscriber and end user. However not adopting this feature will likely increase the time to troubleshoot and resolve issues.
More about “Grant Login Access” can be found here: https://help.salesforce.com/apex/HTViewHelpDoc?id=granting_login_access.htm
Infrastructure
All of our product services are run in the cloud. Tapply does not run our own routers, load balancers, DNS servers, or physical servers. The vast majority of our services and data are hosted by Salesforce.
Application Architecture
Taskfeed runs on Salesforce, so our customers benefit from all the innovation and security of the Salesforce platform. This means all logic and code is processed either by Salesforce or within your browser.
Application Security
Salesforce has security built into every layer of the Platform.
The infrastructure layer comes with replication, backup, and disaster recovery planning. Network services has encryption in transit and advanced threat detection. Salesforce application services implement identity, authentication, and user permissions. Salesforce also offer an additional layer of trust with Salesforce Shield, including Platform Encryption, Event Monitoring, and Field Audit Trail.
Taskfeed leverages Salesforce Platform security features where appropriate.
Salesforce AppExchange Security Review
Taskfeed is enrolled in the ISVForce Partner Program (AppExchange) and as part of this program is a mandatory periodic security review. The Security Review has been developed to assess the security of partner offerings and to ensure that applications published on the AppExchange follow industry best practices for security.
Personal Data
Nature and Purpose of Processing
Through the use of Taskfeed and other services we provide we will process your employees personal data and potentially your customers personal data residing in Salesforce. The Taskfeed application may use data available within your Salesforce environment including employee, customer, prospect or partner personal data to fulfill the objectives of its purpose, as further specified in the Documentation, and as further instructed by the Customer in its use of the Services. This processing all happens within your own Salesforce environment as described in the “Our access to your data” section above.
Known examples where Personal Data may be processed by the service are:
Displaying User and Contacts related to Boards and Tasks and other items
Sending notification messages to Users and Contacts
Displaying related User or Contact data within the application
We will additionally collect personal data relating to Users for the provision of support and for the purpose of product analytics. If you provide your customers, partners or any third party access to Taskfeed through Salesforce Communities the we will treat those individuals as Users and collect data for them also. Individuals accessing Taskfeed as Guests through the External Sharing feature are anonymous, personal data will not be collected about these users however anonymous product usage information may be collected.
Duration of Processing
We will Process Personal Data that is provided to the application within Salesforce for the duration that the application is used related to the Personal Data in Salesforce, this could be while there are Taskfeed records related to Salesforce Account, Contacts or other records holding personal data.
Personal data shared with us for the purpose of application analytics and support may be accessed and processed beyond the scope of any agreement.
Categories of Data Subjects
Customer may submit Personal Data to the extent of which is determined and controlled by Customer, and which may include, but is not limited to Personal Data relating to the following categories of data subjects:
Prospects, customers, business partners and vendors of Customer (who are natural persons)
Employees or contact persons of Customer’s prospects, customers, business partners and vendors
Employees, agents, advisors, freelancers of Customer (who are natural persons)
Customer’s Users authorized by Customer to use the Services
Type of Personal Data
The following categories of Personal Data will be collected and shared with Tapply and our sub-processors through the interaction with Taskfeed as User.
Salesforce User ID
First and Last name
Username
Job Title
Position
Employer
Contact information (company, email, phone, physical business address)
Geo-location
Right to Be Forgotten
You may need to delete customer data in order to comply with data protection and privacy regulations. The Salesforce Platform offers a rich set of features to help you meet your obligations under the GDPR. Salesforce allows customers to delete personal data at both an organizational level and an individual level. Deletions of Salesforce instances (orgs) are synced regularly.
https://help.salesforce.com/articleView?id=data_deletion_platform.htm&type=5
Consent
Salesforce Platform helps you comply with data protection and privacy regulations with out-of-the-box support for indicating do not call, email opt-out, and fax opt-out preferences. The Salesforce Platform also now includes an Individual Object for tracking privacy preferences across multiple roles in your organization which can relate to one or many Contacts, Leads, Person Accounts, and custom object records. Taskfeed supports these options or provides additional controls to manage consent when sending notifications to Users or Customers.
Restriction of Processing
On the Salesforce Platform, records can be identified, exported, and deleted upon receiving a verified request to restrict processing. If the restriction is lifted at a later date, the records can be re-imported.
https://help.salesforce.com/articleView?id=restriction_of_processing_platform.htm&type=5
Data Portability
You can use the Salesforce Platform to help you honor your customers’ requests to export their data. Data can be extracted via both UI-driven as well as API-driven methods, including reports and report/dashboard APIs, data loader, Apex, SOAP and REST APIs, and third-party ETL tools. Export formats include CSV, JSON, and XML.
Accountability/Transparency
Both ourselves and Salesforce offers customers a robust data processing addendum containing strong privacy commitments. This addendum also contains specific provisions to assist you in your compliance with the GDPR.
Sub-processors
To provide quality of service Taskfeed uses additional cloud-based application and services. These are designated as sub-processors.
Intercom
Used for application usage monitoring and customer support. When a Visualforce page is loaded, a Javascript file is loaded from the Intercom domain registering usage information alongwith the following Personal Data:
Salesforce User ID
First and Last name
Username
Job Title
Position
Employer
Contact information (company, email, phone, physical business address)
Location
The data Intercom provides Taskfeed is used for usage monitoring of products and features.
Stripe
Stripe is not part of the Taskfeed app but is used for managing credit card subscription to the App. Stripe is provided through an integration with Salesforce and the AppExchange called “Salesforce Checkout”. Stripe manages the subscription payment process.
Find out more about AppExchange Checkout here: http://www.salesforce.com/us/developer/docs/packagingGuide/Content/appexchange_checkout _using.htm
Learn more about Stripe on their website: https://stripe.com/
Reporting a Security Concern
If you have discovered a security issue or want to report a concern regarding the security of Taskfeed please report this immediately to support@taskfeedapp.com.