Cloud Datacenter Security
Outreach’s production infrastructure is hosted on Amazon Web Services as our primary Infrastructure as a Service (IaaS) provider. In addition to AWS’s extensive list of security and privacy certifications, Outreach also implements and attests to its own set of policies and practices to secure your data.
Outreach services run primarily as Kubernetes-controlled containers. Outreach’s policies and standards also govern the management of our container infrastructure.
Data is encrypted both at rest and in transit using the industry-leading encryption standards. Outreach employs a top-tier Data Loss Prevention (DLP) solution to monitor protected information. The Outreach platform provides additional controls, such as governance capabilities, to further protect our customers’ users and their data.Learn More→
All corporate desktops and laptops are managed with enterprise device management and endpoint protection software.
Business Continuity and Disaster Recovery
Outreach maintains a Business Continuity Policy, which mandates that the Business Continuity Plan (BCP), testing, and procedures are updated and performed at least annually.
Security Software Development Lifecycle Standard
The Outreach Software Development Lifecycle (SDLC) standard incorporates security practices throughout our platform’s planning, development, and release processes.
Outreach follows OWASP guidelines in our Security Development Lifecycle. Outreach's SDLC is audited by an independent third party and is attested to in our SOC 2 Type II report.
Bug Bounty Program
Outreach employs a private bug bounty program that enables a large pool of security researchers to test our platform on a continuous basis.Report a Vulnerability→
Outreach contracts with industry-leading penetration testing providers to examine our production architecture at least once a year through more scoped, formal probing.
When a user connects to Outreach, they use a web browser over an enforced Transport Layer Security (TLS) 1.2 or higher connection. The Outreach platform supports federated access via SAML 2.0 in order to provide SSO by any number of Identity Providers (IdP).
Outreach’s system status is publicly available and uptime is continuously monitored.View Platform Status→
Security starts with the people Outreach employs. We implement security controls for employees and contractors before, during, and after their tenure at Outreach. These controls include security and privacy training and automated deprovisioning of both logical and physical access to Outreach resources.
Privacy is critical to our customers and we take it seriously. Outreach does not sell, share, or export your data to third parties we gather from the use of our platform for our own purposes. We only provide data to our subprocessors in support of processing of your data as dictated by your MSA.
Privacy & Safety Features
Our product offers the ability to configure the product to your operational needs including granular governance controls.
We regularly back up your data and provide a maximum 24-hour RTO and RPO.
Customers can delete users, emails, and other associated prospect data directly from our Compliance Request service within the platform. If customers want to terminate their relationship with Outreach, all their data will be removed from our systems within 60 days.Learn More→