Security Policy & Architecture Overview

Security is engineered into every layer of the CapEngage platform. We maintain a defense-in-depth security model designed to safeguard customer databases, API integrations, campaign assets, and user credentials against unauthorized access, loss, or disclosure.

Our security framework aligns with industry standards including SOC 2 Type II controls, ISO/IEC 27001 ISMS guidelines, and NIST Cybersecurity Framework recommendations.

CapEngage is hosted on tier-1 cloud infrastructure providers (Amazon Web Services and Google Cloud Platform) in ISO 27001 and SOC 2 certified data centers.

• Physical Security: Data centers feature 24/7 physical security guards, biometric access controls, video surveillance, and redundant power generators. • Network Isolation: Application servers and database clusters reside within private Virtual Private Clouds (VPC) protected by web application firewalls (WAF) and strict security group rules. • DDoS Protection: Automated distributed denial-of-service (DDoS) mitigation shields edge routes and API endpoints against volumetric traffic spikes.

CapEngage enforces industry-standard end-to-end encryption across all states of customer data:

• Encryption in Transit: All network communications between users, browsers, APIs, and sub-processors are encrypted using Modern TLS 1.3 (with fallback to TLS 1.2). Weak ciphers are disabled. • Encryption at Rest: All relational databases, document stores, cached memory stores, and database backups are encrypted using AES-256 bit encryption via AWS Key Management Service (KMS). • Secret Management: API keys, webhook secrets, and database credentials are stored in dedicated hardware security modules (HSM) and rotated on schedule.

We enforce strict access controls governing internal staff and customer platform access:

• Role-Based Access Control (RBAC): Platform administrators can configure custom user roles (Owner, Admin, Analyst, Marketer) to restrict access to sensitive customer databases or financial settings. • Multi-Factor Authentication (MFA): Mandatory MFA enforcement support via Time-based One-Time Password (TOTP) apps. • Single Sign-On (SSO): Enterprise plans support SAML 2.0 and OpenID Connect (OIDC) integration with Okta, Azure AD, and Google Workspace. • Employee Least Privilege: CapEngage employees access production environments solely through encrypted bastion hosts requiring MFA and explicit manager authorization.

We execute continuous testing to identify and remediate security risks:

• Automated SAST & DAST: Static and dynamic code analysis integrated into our continuous integration (CI/CD) deployment pipeline. • Penetration Testing: Annual third-party penetration audits conducted by independent CREST-accredited cybersecurity firms. • Dependency Scanning: Automated monitoring of third-party libraries for CVE vulnerabilities. • Vulnerability Disclosure: We operate a responsible disclosure program allowing researchers to submit vulnerabilities to security@capengage.com.

To ensure continuous platform availability and data durability:

• Database Backups: Automated point-in-time database snapshots replicated across multiple availability zones. • Recovery Point Objective (RPO): Less than 1 hour for database data. • Recovery Time Objective (RTO): Less than 4 hours for full system restoration. • Business Continuity Testing: Annual disaster recovery failover exercises to validate multi-region backup integrity.

CapEngage maintains a dedicated Security Incident Response Team (SIRT) operating 24/7.

In the event of a confirmed security incident impacting Customer Data, CapEngage will notify affected customers via email without undue delay, and in all cases within seventy-two (72) hours of confirmation, providing incident details, affected data categories, and remediation measures.