Enterprise Security & Compliance: SOC 2, ISO 27001, and Beyond

## The Security Questionnaire Problem Every enterprise vendor evaluation starts the same way: a 200-question security questionnaire. Does your vendor encrypt data at rest? Do they have incident response procedures? When was their last penetration test? For a consent management platform, these questions are especially critical. You're trusting a vendor with: - Consent records (legally required evidence) - User interaction data (potential PII) - Website integration (code running on your pages) This article documents GetCookies' security posture so your security team can evaluate us efficiently. ## Compliance Framework Alignment ### SOC 2 Type II GetCookies' security controls align with SOC 2 Trust Service Criteria: **Security** - Access controls and authentication - Network and infrastructure security - Encryption of data in transit and at rest - Vulnerability management **Availability** - Redundant infrastructure - Disaster recovery procedures - Uptime monitoring and SLAs **Confidentiality** - Data classification and handling - Access restrictions - Encryption controls **Processing Integrity** - Input validation - Error handling - Quality assurance ### ISO 27001 Our Information Security Management System (ISMS) follows ISO 27001 structure: - **Context and Scope**: Cloud-based consent management platform - **Leadership**: Designated security responsibility - **Risk Assessment**: Regular threat modeling and risk evaluation - **Controls**: Annex A control implementation - **Performance Evaluation**: Continuous monitoring and metrics - **Improvement**: Incident learning and control enhancement ## Data Protection ### Encryption at Rest | Data Type | Encryption | Key Management | |-----------|------------|----------------| | Database | AES-256 | AWS KMS | | File Storage | AES-256 | AWS KMS | | Backups | AES-256 | Separate keys | | Logs | AES-256 | Rotation policy | ### Encryption in Transit - TLS 1.2+ enforced for all connections - HSTS enabled with preload - Certificate pinning for mobile SDKs - Perfect Forward Secrecy enabled ### Data Residency - Primary: AWS EU (Frankfurt) - Backups: AWS EU (Ireland) - No data transfer outside EU without explicit configuration - US region available for US-only customers ## Access Control ### Authentication | Method | Use Case | |--------|----------| | Email/Password | Standard login | | Magic Link | Passwordless option | | Google OAuth | SSO integration | | SAML SSO | Enterprise (custom) | | MFA | Available for all accounts | ### Authorization **Role-Based Access Control (RBAC)**: - **Owner**: Full account control - **Admin**: All operations except billing - **Editor**: Domain and widget management - **Viewer**: Read-only access **Scoped API Keys**: - Per-domain restrictions - Operation-specific scopes - Automatic expiration options ### Session Management - JWT-based tokens - 15-minute access token expiry - 7-day refresh token expiry - Session revocation capability - Concurrent session limits ## Audit Logging ### What We Log | Event Category | Examples | |---------------|----------| | Authentication | Login, logout, failed attempts | | Authorization | Permission changes, role updates | | Data Access | Domain views, consent log access | | Configuration | Widget updates, scan settings | | Administrative | User management, API key creation | ### Log Retention - Authentication logs: 2 years - Access logs: 1 year - Configuration changes: Indefinite - Consent records: Configurable (default 7 years) ### Log Security - Immutable storage - Tamper detection - Encrypted at rest - Separate access controls ## Vulnerability Management ### Scanning | Type | Frequency | Tools | |------|-----------|-------| | Dependency scanning | Every build | Snyk, npm audit | | Static analysis | Every PR | CodeQL, ESLint security | | Container scanning | Every build | Trivy | | Infrastructure scanning | Weekly | AWS Inspector | ### Patching - Critical vulnerabilities: 24-hour response - High vulnerabilities: 7-day response - Medium vulnerabilities: 30-day response - Low vulnerabilities: Quarterly review ### Penetration Testing - Annual third-party penetration test - Quarterly internal security assessments - Bug bounty program (responsible disclosure) - Results available under NDA ## Incident Response ### Response Phases **1. Detection** - Automated alerting (< 5 minute detection) - 24/7 on-call rotation - Multiple detection channels (logs, metrics, anomalies) **2. Containment** - Immediate threat isolation - Access revocation if needed - Service preservation when possible **3. Eradication** - Root cause identification - Threat removal - System hardening **4. Recovery** - Service restoration - Data integrity verification - Monitoring enhancement **5. Lessons Learned** - Post-incident review - Control improvements - Documentation update ### Notification Timeline | Severity | Customer Notification | |----------|----------------------| | Critical | Within 4 hours | | High | Within 24 hours | | Medium | Within 72 hours | | Low | Monthly summary | ## Backup and Disaster Recovery ### Backup Strategy | Data Type | Frequency | Retention | |-----------|-----------|-----------| | Database | Continuous (WAL) | 30 days | | Daily snapshot | Daily | 90 days | | Weekly archive | Weekly | 1 year | | Monthly archive | Monthly | 7 years | ### Recovery Objectives - **RPO (Recovery Point Objective)**: 1 hour - **RTO (Recovery Time Objective)**: 4 hours ### Disaster Recovery Testing - Quarterly DR drills - Annual full failover test - Documented runbooks - Automated recovery procedures ## Infrastructure Security ### Cloud Security - AWS with security best practices - VPC isolation - Security groups with least privilege - No public database access - Private subnets for application tier ### Network Security - WAF protection - DDoS mitigation - Rate limiting - IP allowlisting (optional) - Geographic restrictions (configurable) ### Container Security - Minimal base images - No root execution - Read-only filesystems where possible - Regular image updates - Runtime monitoring ## Third-Party Security ### Vendor Assessment All third-party services undergo: - Security questionnaire review - SOC 2 report review (where available) - Data processing agreement - Ongoing monitoring ### Critical Vendors | Vendor | Purpose | Security Posture | |--------|---------|------------------| | AWS | Infrastructure | SOC 2, ISO 27001 | | Cloudflare | CDN/WAF | SOC 2, ISO 27001 | | Stripe | Payments | PCI DSS Level 1 | | Resend | Email | SOC 2 | ### Data Subprocessors Full list of subprocessors available at [getcookies.co/legal/subprocessors](https://getcookies.co/legal/subprocessors). ## Employee Security ### Background Checks - Identity verification - Employment history - Reference checks - Criminal background (where legal) ### Training - Security awareness training (annual) - Phishing simulation (quarterly) - Secure development training - GDPR/privacy training ### Access - Principle of least privilege - Just-in-time access for production - Access reviews (quarterly) - Immediate offboarding procedures ## Security Governance ### Policies - Information Security Policy - Acceptable Use Policy - Data Classification Policy - Incident Response Policy - Business Continuity Policy - Vendor Management Policy ### Reviews - Annual policy review - Quarterly control effectiveness - Monthly security metrics - Weekly vulnerability review ### Responsibility - Designated security lead - Cross-functional security committee - Board-level security reporting ## Requesting Security Documentation Enterprise customers can request: - SOC 2 Type II report (under NDA) - Penetration test executive summary - Detailed security questionnaire responses - Custom security assessments Contact: [email protected] ## Security Questionnaire Quick Reference | Question | Answer | |----------|--------| | Data encrypted at rest? | Yes, AES-256 | | Data encrypted in transit? | Yes, TLS 1.2+ | | MFA available? | Yes | | SSO supported? | Yes (SAML, OAuth) | | SOC 2 certified? | Aligned, report available | | Penetration tested? | Annual, report available | | GDPR compliant? | Yes | | Data residency options? | EU (default), US | | Audit logs available? | Yes, 2-year retention | | SLA available? | Yes, 99.9% uptime | ## Getting Started Enterprise security evaluation process: 1. Request security documentation 2. Review SOC 2 report 3. Complete vendor security questionnaire 4. Schedule security call if needed 5. Execute DPA and proceed We built GetCookies to help companies meet privacy requirements. It would be hypocritical if we didn't meet the highest security standards ourselves.