Our privacy policy

Overview

Contlify implements comprehensive organizational and technical measures ("Security Practices") designed to protect the information you provide ("Customer Information") against loss, misuse, unauthorized access, alteration, or disclosure. These Security Practices are continuously evaluated and improved, taking into account the sensitivity of the data collected, processed, and stored, the current state of technology, implementation costs, and the nature, scope, context, and purposes of data processing carried out by Contlify.

We are committed to maintaining the trust and confidence of our users. We want you to know that Contlify is not in the business of selling, renting, or trading email lists with other companies and businesses for marketing purposes. We take your privacy seriously and take measures to provide all users of Contlify with a safe and secure experience.

For the purposes of this document, "Contlify Services" include all self-serve and enterprise-level services offered by Contlify, as governed by the applicable agreement between you and Contlify. Capitalized terms not defined herein have the meanings assigned to them in that agreement. This policy applies to all information collected or submitted on Contlify's website and through our applications and services.

1. Assigned Security Responsibility

Contlify has designated a security officer and maintains a dedicated security team responsible for the development, implementation, oversight, and continuous improvement of Contlify's Security Practices. This team is composed of experienced security professionals who are trained in the latest security technologies and methodologies.

Our security team regularly reviews and updates our security policies to ensure they meet or exceed industry standards. They work closely with all departments to ensure that security is integrated into every aspect of our operations, from product development to customer support. The security officer reports directly to executive leadership to ensure that security concerns receive appropriate attention and resources.

2. Personnel Practices

All Contlify employees and contractors are required to comply with internal policies governing the confidential handling of Customer Information. Before gaining access to any customer data, all personnel must complete comprehensive security training that covers data handling procedures, privacy regulations, and our internal security policies.

Mandatory security and privacy training is conducted during onboarding and repeated annually, tailored to each employee's role and responsibilities. This training covers topics including but not limited to: recognizing phishing attempts, proper data handling procedures, incident reporting protocols, and compliance with applicable privacy regulations such as GDPR and CCPA.

Employees are required to formally acknowledge information security policies emphasizing confidentiality, integrity, availability, and resilience of Contlify systems and services. This acknowledgment is renewed annually and whenever significant policy updates are made.

Access to Customer Information is strictly limited to authorized personnel on a role-based, least-privilege basis. This means employees only have access to the data they need to perform their specific job functions. Pre-employment background checks are conducted for sensitive roles where legally permissible, and we maintain strict offboarding procedures to ensure access is revoked immediately when employment ends.

3. Compliance and Independent Testing

Contlify undergoes annual independent security audits, including SOC 2 Type II assessments conducted by qualified third-party auditors. These audits evaluate our security controls, policies, and procedures to ensure they meet industry standards for security, availability, processing integrity, confidentiality, and privacy. Audit reports may be made available to enterprise customers under a confidentiality agreement upon request.

Payment processing is handled exclusively by PCI DSS–compliant third-party providers. Contlify does not store or process raw credit card data and retains only anonymized transaction tokens. This ensures that your payment information is handled with the highest level of security and compliance with payment card industry standards.

Contlify conducts regular third-party penetration testing on its web and application infrastructure to identify and remediate security vulnerabilities. These tests simulate real-world attack scenarios to identify potential weaknesses before they can be exploited. Any vulnerabilities discovered are prioritized and addressed according to their severity level.

4. Access Controls

Contlify enforces strict access control policies to protect Customer Information and system resources. Our access control framework includes formal onboarding, offboarding, and role-transition procedures to ensure that access rights are appropriately granted, modified, or revoked as personnel changes occur.

We maintain regular access reviews and controlled administrative privileges. Administrative access is limited to a small group of authorized personnel and requires additional authentication measures. Session timeout and inactivity safeguards automatically terminate sessions after periods of inactivity to prevent unauthorized access.

Segregation of duties is implemented to reduce security risks by ensuring that no single individual has complete control over critical processes. We maintain an up-to-date inventory of system and user accounts and enforce least-privilege and need-to-know access principles throughout the organization.

Controls limiting login attempts and concurrent sessions help prevent brute force attacks and unauthorized access. Strong password policies are enforced, including minimum complexity requirements, forced password changes after initial login, periodic rotations, and reuse restrictions. We encourage all users to use unique, strong passwords and to enable multi-factor authentication for additional security.

5. Multi-Factor Authentication (MFA)

Multi-factor authentication is enforced for Contlify employees and contractors accessing internal systems. This additional layer of security requires users to verify their identity using two or more authentication factors, such as something they know (password), something they have (mobile device or security key), or something they are (biometric verification).

MFA is also available to customers and authorized users to strengthen account security. We strongly recommend that all users enable MFA on their accounts to protect against unauthorized access, even if their password is compromised. Our platform supports various MFA methods including authenticator apps, SMS verification, and hardware security keys.

6. Single Sign-On (SSO)

Contlify utilizes Single Sign-On (SSO) internally and provides SSO capabilities to enterprise customers for centralized and secure access management. SSO allows users to authenticate once and gain access to multiple applications without re-entering credentials, improving both security and user experience.

Our SSO implementation supports industry-standard protocols including SAML 2.0 and OAuth 2.0, enabling seamless integration with popular identity providers. Enterprise customers can integrate Contlify with their existing identity management systems, enabling centralized user provisioning, access control, and audit logging.

7. Data Encryption

All data transmitted to and from Contlify Services is encrypted using industry-standard protocols, including TLS 1.2 and TLS 1.3. This ensures that data in transit is protected from eavesdropping and man-in-the-middle attacks. We regularly update our encryption protocols to maintain compatibility with the latest security standards.

Data encryption at rest is applied where appropriate based on data sensitivity and risk assessment. Sensitive customer data stored in our databases and file systems is encrypted using AES-256 encryption, one of the strongest encryption standards available. Encryption keys are managed securely and rotated regularly.

Certain sensitive data, such as scheduled content and approval workflows, receives additional encryption protections. Contlify continuously monitors cryptographic best practices and adapts to emerging vulnerabilities while maintaining compatibility where necessary. We stay informed about developments in cryptography and quantum computing to ensure our encryption remains effective.

8. Logging and Intrusion Detection

System components including firewalls, servers, and network devices generate security logs stored in secure, centralized logging systems. These logs capture important security events such as authentication attempts, access requests, system changes, and potential security incidents.

Logs are monitored using automated tools and reviewed by the security team for anomalies and potential threats. Our security information and event management (SIEM) system correlates events across multiple sources to identify suspicious patterns that might indicate a security breach or attack in progress.

Contlify employs network-based and host-based intrusion detection systems, along with Web Application Firewalls (WAFs), to detect and prevent unauthorized activity. These systems are continuously updated with the latest threat intelligence to protect against emerging attack vectors and known vulnerabilities.

9. Network Protection

Firewalls and network security controls are deployed to restrict access to required ports only. Non-essential ports and services are blocked to reduce attack surface. Our network architecture follows the principle of defense in depth, with multiple layers of security controls to protect against various types of attacks.

Network traffic is monitored and analyzed for suspicious activity. We implement network segmentation to isolate sensitive systems and data from less secure areas of the network. This limits the potential impact of a security breach and makes it more difficult for attackers to move laterally within our infrastructure.

10. Host Management

Automated vulnerability scans are conducted on production systems on a regular basis to identify potential security weaknesses. These scans check for known vulnerabilities in operating systems, applications, and configurations that could be exploited by attackers.

Identified risks that pose material threats are remediated within commercially reasonable timeframes based on severity. Critical vulnerabilities are addressed immediately, while lower-severity issues are prioritized and scheduled for remediation according to our vulnerability management process.

Company-managed devices utilize full disk encryption and enforced screen lock policies to protect data in case of device loss or theft. Endpoint protection software is deployed on all company devices to detect and prevent malware infections. We maintain an inventory of all hardware and software assets and ensure they are kept up to date with security patches.

11. Availability

Contlify's infrastructure is designed for high availability and fault tolerance, consistent with its service commitments and applicable SLAs. Our systems are architected with redundancy at multiple levels to minimize the risk of service interruptions due to hardware failures, software issues, or other technical problems.

We utilize load balancing, automatic failover, and geographic distribution to ensure that our services remain available even in the event of component failures or regional outages. Our operations team monitors system health around the clock and responds quickly to any issues that may affect service availability.

12. Disaster Recovery & Backups

Customer Information is redundantly stored across multiple geographic locations to protect against data loss due to regional disasters or infrastructure failures. Our backup strategy ensures that customer data can be recovered in the event of accidental deletion, corruption, or other data loss scenarios.

Regular backups are performed and securely maintained with appropriate retention periods. Backups are encrypted both in transit and at rest, and access to backup systems is strictly controlled and audited.

Backup restoration procedures are tested at least every 90 days to ensure that backups are complete and can be successfully restored when needed. Operational teams receive real-time alerts in the event of system failures or incidents, enabling rapid response and recovery.

13. Physical Security

Contlify leverages reputable cloud infrastructure providers that maintain strong physical and environmental security controls. Our infrastructure partners operate data centers with 24/7 security personnel, video surveillance, and multi-factor access controls for physical entry.

These facilities comply with recognized international standards such as ISO 27001/27017/27018, SOC 1, SOC 2, SOC 3, and PCI DSS Level 1 certifications. Environmental controls including fire suppression, climate control, and redundant power systems protect against physical threats to our infrastructure.

14. Security Policies & Frameworks

Contlify's security program aligns with the NIST Cybersecurity Framework and industry best practices. This framework provides a structured approach to managing cybersecurity risk and includes functions for identifying, protecting, detecting, responding to, and recovering from security incidents.

Our security measures include one-way salted hashing of passwords using industry-standard algorithms, strict prohibition against logging plaintext passwords, and comprehensive access and audit logging. We regularly review and update our security policies to address emerging threats and incorporate lessons learned from security incidents.

15. Secure Product Development

All new features and system changes undergo formal security review prior to release. Our secure development lifecycle (SDL) integrates security considerations into every phase of the development process, from design through deployment and maintenance.

Code is subjected to automated testing and manual peer review before deployment. Static and dynamic analysis tools are used to identify potential security vulnerabilities in code before it reaches production. Developers receive regular training on secure coding practices and common vulnerability patterns.

Security, engineering, and product teams collaborate to address security and privacy risks early in the development lifecycle. This shift-left approach helps identify and remediate security issues when they are less costly to fix and before they can impact customers.

16. Incident Management & Response

Contlify maintains documented incident response procedures to address security events promptly and effectively. Our incident response plan defines roles and responsibilities, communication protocols, and escalation procedures to ensure a coordinated response to security incidents.

In the event of unauthorized access or disclosure of Customer Information, affected customers will be notified without undue delay, in accordance with applicable legal requirements. Notifications will include information about the nature of the incident, the types of data affected, and steps customers can take to protect themselves.

Following any security incident, we conduct a thorough post-incident review to identify root causes and implement improvements to prevent similar incidents in the future. Lessons learned are incorporated into our security training and awareness programs.