Security at Drift

Per Article 32 of the GDPR, we have in place appropriate technical and organizational measures to keep your data secure. All data is securely stored in Amazon Web Services.

You can configure Drift to collect consents via chat prior to collecting email address or additional personal data.

Drift is able to read the consent flag passed from your Consent Management Platform (CMP) and act accordingly.

We have in place the appropriate Data Processing Agreements (DPAs) with all vendors and sub-processors that process data on our behalf. Check out the Sub-processor section below for more information on how we vet and contract with our sub-processors.

We have processes in place to honor data subject requests. Drift will export, correct, or delete Contact Data upon request by the Customer. If we receive a request directly from a Data Subject, we will work with the Customer to honor the request.

At Drift, we consider every single employee to be a member of the security team, and are dedicated to keeping all of our data and our customers’ data secure. That said, we do have a dedicated Security Team, including a Chief Security Officer who holds the following credentials: CISSP, CIA, CFE, CCEP, CIPP/US, ISO 27001 Lead Implementer and is a licensed attorney and investigator.

Yes. Drift undergoes annual application and network penetration tests conducted by nationally recognized firms.

Drift has four sub-processors, available at www.drift.com/gdpr/. All Customer Data is stored in AWS. The other sub-processors may or may not see a particular Customer’s data depending on which Drift products and services that customer is using.

Drift continuously scans and monitors our production environment to detect possible intrusion and performs static and dynamic code analysis on a regular basis.

You can contact us via chat or email us at security@drift.com. You can also submit a bug through our bounty program here.

Only employees who need to access data in order to help perform the services will access customer data.

Absolutely. Data can be deleted or we can deliver all data collected and stored on behalf of a customer to that customer.

Data is completely wiped according to NIST 800-88 standards, such that data cannot be retreived in part or whole after deletion.

Drift is a SaaS platform that is 100% cloud-based in Amazon Web Services. We do not operate our own physical servers, routers, load balancers, or DNS servers. All of our servers are within our own virtual private cloud (VPC) with network access control lists (ACLs) that prevent unauthorized requests from reaching our internal network. Customer data is stored in either our Drift North American data center or our Drift EU data center, depending on the customer’s contract.

Yes! We have processes in place to honor data subject requests. Drift will export, correct, or delete Contact Data upon request by the Customer. If we receive a request directly from a Data Subject, we will work with the Customer to honor the request.

Whether data is being transferred or stored, all customer data is secured with the latest encryption algorithms and technologies.

At rest, all data lives within our Amazon Web Services (AWS) infrastructure located in US-EAST datacenters. Resting data is encrypted using AWS provided technologies, which use a symmetric AES-GCM encryption algorithm with 256 bit encryption keys. Encryption keys are stored separately from encrypted data using AWS’ Key Management System (KMS).

During transit, either externally or internally between Drift services, data is encrypted using TLS 1.2 with AES 256 bit encryption to ensure data protection at all times. Drift SSL certificates are issued through AWS, and when Drift sends data to third-party systems data is encrypted by leveraging the SSL certificates owned by our partners. Drift is certified under the EU/Swiss-U.S. Privacy Shield Framework and all our agreements with sub-processors require that data only be transferred pursuant to Privacy Shield Certifications or mutually executed Standard Contractual Clauses.

Drift utilizes geographically separate environments to ensure data availability and uptime. In the unlikely event of simultaneous failure of both environments, Drift maintains daily backups, meaning that the RPO is no greater than 24 hours.

The Customer owns all the data they have collected and stored using Drift. Drift does not use Personal Data collected on behalf of a customer for any purpose other than to perform the services. Drift will perform some analytics on aggregate usage information which we use to improve our services and enable our customers to be successful with Drift.

Drift participates in the EU-U.S. Privacy Shield framework (“Framework”) as set forth by the U.S. Department of Commerce, regarding the processing of personally identifiable information transferred from the EU and European Economic Area (“EEA”) to the U.S. Drift has certified that it adheres to the Privacy Shield Principles. To learn more about the Framework and to view our certification page, please visit https://www.privacyshield.gov/.

Drift will also enter into Standard Contractual clauses for cross-border data transfers.

Check out our GDPR page for details on this.

Absolutely not.

Yes! Drift is SOC II Type 2 certified and Privacy Shield Certified.

With respect to the data collected and stored by our Customers, the Customer is the Data Controller, and Drift is the Data Processor. We will enter into a Data Processing Agreement or DPA with any Customer that requests one.

Yes. Every new vendor must be vetted by the Legal and Security teams. This process includes completion of a detailed questionnaire, analysis of whether the vendor will have access to personal data, and submission of their penetration tests and security certifications.

Yes. You can submit a bug here.