Dataminr Trust Services
Dataminr’s commitment to privacy, security and compliance is integral to our mission. Our services are web-based, and our real-time, AI-powered alerts on high-impact events and critical information are delivered to users via a web-based app, mobile app, email and/or push notifications.
Want to learn more about Dataminr’s privacy and security practices? Review our third-party audit reports.
Privacy and security by design
Dataminr embeds privacy and security throughout its systems and software design life cycle to ensure that controls are well designed and operating effectively. Privacy and security controls are documented and enforced by dedicated internal teams as well as verified by qualified, internationally accredited third-party auditors to provide assurance to customers.
Third-party verification and compliance
- Dataminr is SOC 2 Type 2, NIST 800-171, ISO/IEC 27001:2013, ISO/IEC 27701:2019, and UK Cyber Essentials Plus certified. External audits are conducted annually to ensure continued compliance with these frameworks.
- Comprehensive application and network penetration testing is conducted at least annually by qualified, independent security firms that are rotated for diverse coverage.
Our Cybersecurity & Trust and Legal teams
The integrated privacy and security program at Dataminr is managed by our Cybersecurity & Trust and Legal teams. Dataminr has a dedicated internal privacy counsel and a Data Protection Officer (DPO). Additionally, Dataminr maintains a 24/7/365 security operations center (SOC) to ensure continuous customer protection.
How we protect privacy
Privacy impact assessments
We have developed processes for conducting privacy impact assessments, data processing impact assessments and other applicable assessments.
Third-party vendors
We operate a vendor onboarding process that includes conducting risk assessments and performing proper due diligence prior to entering into contractual agreements with vendors.
Data residency
Dataminr is headquartered in the United States with subsidiaries in the United Kingdom, Ireland, France, Germany, Denmark and Australia. Dataminr’s platform is currently hosted on AWS in Northern Virginia, United States.
Data governance
We apply, as appropriate, data protection and privacy principles to Dataminr’s data processing activities, including, without limitation, those addressing confidentiality, limitations on data access and use, data minimization, data security and purpose limitation.
Privacy affiliations
Dataminr’s dedicated privacy and security professionals hold numerous certifications from key organizations such as the Information Systems Audit and Control Association (ISACA) and the International Association of Privacy Professionals (IAPP). Dataminr is a corporate member of the IAPP.
Privacy policy
We make our privacy policy available to data subjects, which provides information on Dataminr and its data processing activities.
General Data Protection Regulation (GDPR)
Dataminr has implemented numerous processes and technologies to ensure GDPR compliance.
California Consumer Privacy Act (CCPA)
Since Dataminr conducts business in the state of California, we are also subject to the California Consumer Privacy Act (CCPA). Dataminr has policies, procedures, and defined responsibilities to ensure compliance with CCPA, as well as mechanisms for appropriate, prompt processing of requests from California residents.
How we provide security
Incident management
Dataminr has implemented a NIST and SANS-based incident response plan that includes clearly defined roles and responsibilities, communication requirements, as well as procedures for incident preparation, detection/identification, escalation, containment, eradication, recovery, and lessons learned. Appropriate channels for reporting incidents are communicated and maintained.
Data loss prevention (DLP)
Dataminr has implemented a multi-tiered approach to DLP covering both engineering and corporate information resources. Dataminr’s DLP solution enables systematic detection and prevention of suspicious or inappropriate data handling, creating an additional layer of protection for personal and otherwise confidential data.
Network security
Dataminr utilizes a multi-layered approach to security with extensive use of security groups configured to implicitly deny all traffic and explicitly allow only well-defined, permitted traffic. Additionally, industry standard WAF technology is maintained to protect Dataminr’s customer applications.
Logging and monitoring
Dataminr conducts infrastructure and application logging utilizing industry standard software solutions. Intrusion prevention and detection systems are monitored by Dataminr’s 24/7/365 SOC.
Encryption
Dataminr leverages industry standard encryption technologies to ensure that the confidentiality of personal data is protected. Customer data is encrypted both at rest, utilizing AES-256, and in transit via TLS 1.2.
Threat intelligence
Dataminr utilizes third-party threat intelligence services together with internal analysis to increase awareness and assess relevance to Dataminr’s platform for potential remediation. Real-time threat intelligence information includes, but is not limited to, denial of service, zero day, public exploits and actively exploited vulnerabilities.
Vulnerability and patch management
Internal and external application and network scans are conducted utilizing industry standard software solutions. Any needed risk treatments are promptly identified, documented, and prioritized according to risk level by qualified personnel.
Availability
Business continuity & disaster recovery
Dataminr maintains business continuity and disaster recovery (BCDR) plans that outline the procedures to be followed in the event of an incident. Redundant availability zones within Dataminr’s AWS infrastructure help to safeguard availability. BCDR testing is conducted at least annually, including a lessons learned component, to inform enhancements as needed.
Access management
Dataminr utilizes cloud infrastructure as a service (IaaS), leveraging modern containerized micro-service architecture, zero trust network segmentation and industry standard encryption practices. All data centers incorporate biometric access controls, extensive security cameras, 24/7 security personnel and maintain a complete log of access events. Access controls are maintained via an automated provisioning system to help ensure current information.
Dataminr utilizes a strictly need-based approach to managing user access. Unique user identifiers (UUIDs) are required for each individual accessing the platform. Access to Dataminr’s production environment is protected by a VPN with multi-factor authentication (MFA). Dataminr fully supports SAML 2.0 for integration with customer single sign-on (SSO) solutions.
Risk management
Change Management
Systems & software development life cycle
Dataminr takes a privacy-and-security-by-design approach throughout the systems and software development life cycle (SDLC). Approval processes, segregation of duties, peer code review, static code analysis, and QA are incorporated as part of the SDLC to help prevent unauthorized or otherwise harmful changes. Dataminr maintains separate test and production environments; client data is not permitted in Dataminr’s test environment.
Configuration management
Configuration baselines are clearly established and enforced throughout the platform, and hardening standards are consistently applied. Reviews and updates of baseline configurations are regularly conducted, and solutions have been implemented to prevent deviations.
