Security is one of the top concerns for businesses moving to a cloud-based solution. Entrusting your data to a third-party SaaS service provider requires rigorous security measures. More than 125,000 customers trust Zendesk with their data and Zendesk takes this responsibility seriously. To ensure customer and business data is always protected, Zendesk combines enterprise-class security features with comprehensive audits of our applications, systems, and networks. Our customers know their information is safe, their interactions are secure, and their businesses are protected.
Zendesk’s CX products and solutions meets rigorous security, privacy, and compliance standards, including:
- ISO 27001:2013
- ISO 27018:2014
- SOC 2 Type II
- EU-US & Swiss-US Privacy Shield Certification
- TRUSTe Enterprise Privacy Certification
Zendesk leverages secure components, such as FIPS-140 certified encryption solutions, to protect customer data. Portions of the Zendesk solution can be configured to meet PCI and HIPAA/HITECH Attestation standards. Zendesk has also developed and created tools to allow our customers to meet their obligations under GDPR.
With secure-by-design, cloud-native architecture built on Amazon Web Services (AWS), Zendesk delivers value quickly and scales on-demand. Security is an important part of everything Zendesk designs.
Physical security
Zendesk ensures the confidentiality, availability and integrity of your data with industry best practices. In addition, Zendesk operates in data centers that have been certified as ISO 27001, PCI/DSS Service Provider Level 1, and SOC II compliance.
Application security
Zendesk takes steps to securely develop and test against security threats to ensure the safety of your data. Zendesk maintains a Secure Development Lifecycle, in which training our developers, and performing design and code reviews, takes a prime role. In addition, Zendesk employs third-party security experts to perform detailed penetration tests on different applications within our family of products.
Data security
Zendesk data security includes:
- Encryption In Transit: Communications between customer and Zendesk servers are encrypted via industry best-practices HTTPS and Transport Layer Security (TLS) over public networks. TLS is also supported for encryption of emails.
- Encryption At Rest: As a Zendesk customers, you benefit from the protections of encryption at rest for your primary and secondary DR data stores and storage of attachments.
Availability and business continuity
Zendesk maintains a Disaster Recovery program to ensure services remain available or are easily recoverable in the case of a disaster. This includes service clustering and network redundancies to eliminate single points of failure. You can remain up-to-date on availability issues through a publicly-available Status website that includes scheduled maintenance information and service incident history.
Network security
Zendesk maintains a globally-distributed Security team. The team is available 24/7 to respond to security alerts. Zendesk keeps a continuous watch on the security of our customer’s data with network vulnerability scanning and the use of intrusion detection and prevention systems. Zendesk also participates in Threat Intelligence Programs.
Product security features
Zendesk makes it seamless for account administrators to manage access and sharing policies with authentication and single-sign on (SSO) options. Zendesk also provides for 2-Factor Authentication and IP Restrictions to enable administrators to determine who can access their service. All communications with the Zendesk user interface or APIs are encrypted using industry-standard HTTPS over public networks. Network traffic between our customers and Zendesk is secure.
Compliance certification and membership
Zendesk implements security best practices, in addition to what AWS provides, to meet not just industry-based compliance, but the most stringent requirements, including:
| Membership | Symbol |
|---|---|
| ISO 27001:2013 |  |
| ISO 27018:2014 |  |
| SOC 2 Type II |  |
| EU-US & Swiss-US Privacy Shield Certification |  |
| TRUSTe Enterprise Privacy Certification |  |
Access to data by Zendesk
To help troubleshoot problems within a Zendesk account, customers can allow Zendesk support to assume access to an account for a specific amount of time. By default, account assumption is deactivated and can only be activated by an account administrator. Access can be granted for a set period of time, or indefinitely, and can be turned off at any time. For more information, see Granting Zendesk temporary access to your account.
For more information about Zendesk security
- Download the Zendesk Security and Compliance whitepaper attached to this article.
- Refer to Zendesk's General security best practices for details on how you can help manage the safety of your Zendesk account.
- Send email to security@zendesk.com
0 Comments
Please sign in to leave a comment.