The SaaS mode Nearbound Platform offers an availability rate of 99.9% (ninety-nine dot nine percent) per month, excluding the scheduled maintenance period planned to continuously improve the Nearbound Platform.
For the purpose of this Article, the following terms have the following signification:
Reveal takes charge of the corrective and evolutionary maintenance of the Nearbound Platform.
A support service to deal with Anomalies is available every day from Monday to Friday, at the following email address email@example.com or via an in-app chat, as soon as the questions asked relate to the use of the Services.
Reports of Anomalies must be confirmed by email to Reveal without undue delay. The Customer shall provide Reveal with any information or document characterizing the anomaly that may facilitate Reveal's understanding of the issue encountered.
Reveal undertakes to diagnose the Anomaly and implement its correction under the following conditions:
Reveal’s technical support for the use of the Nearbound Platform includes the following services:
4.1 Technical Measures
(a) Application Security
Reveal uses Sqreen.com to detect and block in real time attacks such as XSS, SQL Injections, Identity Theft etc. We also use Cloudflare to protect our services from Distributed Denial of Service (DDoS) attacks.
(b) Data Encryption in Transit
All HTTP traffic to and from Reveal services is encrypted using TLS with a version greater or equal to 1.2. HSTS is enforced to make sure the browser enforces HTTPS connections.
(c) Databases Security
Databases are hosted within Google Cloud datacenters in Belgium.
All customer data is encrypted at rest using AES-256 encryption, with encryption keys generated by Google Cloud Key Management System.
For the most sensitive data, encryption is applied at the application layer with symmetric encryption keys rotating every 30 days.
Daily backups are operated, which are in the end encrypted as well using AES-256.
Passwords are at least 8 characters long for our users, with at least 1 uppercase letter or numerical character.
They are never stored in clear but as a hash using the bcrypt2 algorithm with 11 stretches and a random salt to prevent brute force and rainbow attacks.
4.2 Organizational Measures
Employees follow a security awareness training program on a yearly basis, including detection of social engineering, phishing, password management etc.
They are required to apply a strong password policy and to use a password manager to limit password reuse.
Multi-factor authentication is required whenever possible, including on the tools that Reveal develops to operate the service.
(b) Securing Devices
All devices are managed automatically using Kandji (MDM), and monitored using Vanta. This includes hard drive encryption, anti-malware installation, automatic updates, firewall configuration, password policy an many other controls (aligned to CIS level 2).
(c) Securing Software
Reveal develops applications following security best practices. Every piece of software written is reviewed by expert eyes, and goes through automated security gates before reaching production environments.
(d) Testing Security
Independent third parties are mandated to perform a various range of security tests:
Vulnerability scanning (continuous)
Processed CRM Data
Standard Clauses & DPA