Medallia has a designated Data Privacy Officer responsible for overseeing data protection strategy and compliance.

All employees complete privacy training to ensure awareness of data protection obligations.

Privileged user access is restricted as per the access management standard. Access requests outside of the role-based access are tracked and approved in the ticketing system.

Customer data access is restricted and monitored, with all access logged and auditable.

Strong password policies and multi-factor authentication protect access to systems and data.

Bring Your Own Device policies ensure personal devices meet security requirements before accessing corporate resources.

The experiences you provide your customers and employees never stop, and neither do we. Our Production Services & Engineering teams utilize internal and external services to perform continuous scanning and monitoring of our network and application to ensure world-class availability of our SaaS platform.

Endpoint protection solutions deployed across all corporate devices.

Full disk encryption enabled on all corporate devices and servers.

Advanced threat detection systems monitor for security events and anomalies.

Medallia uses robust load balancing, malware detection and prevention, and on-demand DoS and DDoS detection and prevention systems.

Medallia has established a Business Continuity Plan to support continued delivery of its products and services after a disaster event that impacts the resources required (i.e., people, technology, physical assets and/or relationships) to support the performance of its critical business processes.

As a cloud-based SaaS provider, Medallia platforms are accessed over the Internet. Medallia's Experience Cloud and Digital platforms are hosted out of colocation facilities, located in North America, Asia, Australia, and Europe.

Medallia uses an internal NTP to ensure all systems have a common time reference.

DXA is built on a robust cloud-based infrastructure that can efficiently scale to handle huge data sets, including seasonal traffic and unexpected visitor surges.

Medallia uses separate environments for development and production, with segmentation ensuring isolation between environments.

Comprehensive asset management ensures all hardware and software assets are tracked and secured.

Medallia has an extensive Security Champions program. Development teams have one or more representatives that take part in an intensive 6-month certified security training program. This ensures that secure development scales as we scale and is part of the DNA and culture of how we build our applications.

Established incident response procedures for timely detection, containment, and remediation of security incidents.

Data protection is a top priority for Medallia. We build our platform using the following core principles: We treat all customer data as private and sensitive. We do not share customer data with third parties without approval of the customer. Our customers are in control of their data with standard, industry compliant policies for deletion and retention. We have architected our platform from the ground up with security and privacy by default. Customer data is labeled as Confidential by Medallia.

Medallia provides application adapters, connectors, and integrations including our Auto Importer (ETL tools for automated data transfer), pre-built connectors at medallia.com/xchange, developer APIs at developer.medallia.com, and batch file transfers via SFTP.

Medallia uses multi-factor authentication for system-level access to our application and backend infrastructure. Support teams must use two-factor authentication to access the application remotely, and employees connect through SSH tunneling (VPN) with public/private key (PKI) two-factor authentication.

User authentication and authorization determines who can access information based on their privileges and role.

Service availability is defined and agreed to within the Master Services Agreement.

Medallia takes access management seriously, granting access with the least privilege needed for the specific role and only to the personnel that need it. We review and update access rights annually and after any change in a user's role. Access to systems that store client data is severely restricted and carefully logged, monitored, and audited.

Any media containing client data will be sanitized or physically destroyed, in accordance with NIST SP 800-88 rev 1 Guidelines for Media Sanitization, before the media is reused or disposed.

Data at rest is encrypted using 256-bit AES encryption.

Data in transit is encrypted using TLS 1.2.

All Medallia access to customer data is audited and logged, including an annual review of all employee access rights.

Medallia has placed appropriate countermeasures in place to protect its office facilities from any physical damage. In addition, Medallia's colocation data centers inherit physical security and environmental controls from the colocation providers. All facilities hosting our services provide the robust physical security and fault-tolerant, highly resilient, redundant support infrastructure necessary to ensure reliable service.

Sensitive data fields can be masked to protect personally identifiable information during session replays and analytics.

Video and media data retention policies ensure content is managed according to customer requirements.

Medallia's Engineering and Product Security teams conduct extensive development and post-development testing to be certain our applications are secure. This includes static and dynamic code analysis and manual penetration testing. All deployed software undergoes a post-deployment vulnerability scan.

Medallia has an extensive Security Champions program. Development teams have one or more representatives that take part in an intensive 6-month certified security training program. This ensures that secure development scales as we scale and is part of the DNA and culture of how we build our applications.

Medallia uses an agile methodology for development. Our software feature development process has five clearly defined lanes or stages: Ready Lane, Development Lane, Code Review Lane, Checkpoint Lane and Merged Lane. Medallia also follows its internal SDLC policy and associated procedures.

Medallia's vulnerability management process includes regular and ad hoc vulnerability scanning. We monitor for vulnerabilities listed in the CVE database and frequently test for threats on the OWASP Top 10 list. Any vulnerabilities identified are analyzed and remediated in accordance with our Vulnerability Management Standard.

Medallia implements secure credential management practices. Passwords and secrets are properly stored using industry-standard encryption, regularly rotated, and access is restricted to authorized personnel only.

Medallia has firewall systems in place to monitor and filter unauthorized inbound network traffic from the Internet, maintain segregation between internal and external networks, and maintain separation between internal wired, wireless, and protected network segments, including Demilitarized Zones (DMZs). With default deny rules in place and deny any type of network connection that is not explicitly authorized, firewall rules are reviewed on an annual basis to ensure firewalls are appropriately configured.

Medallia has electronic intrusion detection systems installed within data server locations to monitor, detect, and automatically alert appropriate personnel of security incidents.

Security Information and Event Management systems aggregate and analyze security events across the infrastructure.

Medallia maintains a list of authorized subprocessors for data processing activities. To receive updates to this list, please sign up at medallia.com/subprocessors.

Comprehensive cyber insurance coverage for data breach and security incident response.

Standard DPA available for customers requiring data processing agreements.

Medallia Digital Experience Analytics (DXA) provides insight into how users interact with websites and applications, enabling organizations to identify friction points and improve digital journeys. Because DXA records interaction data, customers sometimes ask how tools of this kind relate to state privacy and communications laws, particularly the California Invasion of Privacy Act (CIPA) and the Florida Security of Communications Act (FSCA).