last update 2017-07-17
This Policy describes how soccerballs.com (or “We” or “our” or “Us”) secures information collected through www.soccerballs.com (this “Site”). This Policy does not govern our security of information through any website or other means, other than through this Site.
By using this Site, you explicitly accept, without limitation or qualification, our practices surrounding data and systems security. If you do not agree with the terms of this Policy, please do not access, browse, or use this Site.
Security is fundamental to us
soccerballs.com meets all industry standards to safeguard your data. We use a variety of methods to secure our network and servers as well as our software and web applications. Our data retention and business continuity plans are comprehensive and our employees maintain organizational security measures designed to keep your data safe.
Network and server security
- Network infrastructure is segregated into levels of information classification with strict routing, firewalling, and access control links that separate each privilege level.
- Network infrastructure undergoes regular internal penetration testing audits that are augmented by semi-regular third-party audits.
- Our information security team performs regular software updates to remain up-to-date on software security patches.
- Card numbers, mag-stripe data, and security codes are handled in accordance with PCI DSS requirements.
Software and web application security
- Web APIs and web pages are secured with High Assurance SSL certificates that support encryption algorithms with key lengths up to 256 bits and prohibit any key lengths shorter than 128 bits.
- Industry-standard (symmetric and asymmetric) encryption algorithms with appropriately sized keys are used to protect sensitive Customer Information.
- Simple applications undergo regular internal source code audits. Internal audits are augmented by semi-regular third-party audits.
- Standards and leading practices identified by independent security organizations (e.g., OWASP) are integrated in to all Simple code creation processes.
Data retention & Disaster recovery
- Data is aggressively archived and Simple performs regular offsite backups to ensure redundancy.
- soccerballs.com follows industry standard incident response procedures with a dedicated incident response team.
- Prospective employees undergo security screenings during the hiring process.
- Our employees undergo security operations training.
- Our employees use encrypted storage, encrypted chat (and voice), encrypted tunnels (VPN and SSH), and encrypted email for sensitive internal communications and operations.
Security research and disclosure process
We understand the devotion and effort that security work requires. As such, we encourage (and reward) the responsible disclosure of any vulnerabilities to us. Responsible disclosure means:
- Openly share the full details of any vulnerabilities with us.
- Do not announce or share the details of any vulnerabilities in any way with the public or other parties.
- Do not exploit the vulnerability except for purposes of demonstrating it to Us. Please contact email@example.com if you are unsure of exploitability and we will work with you to verify it safely.
- Do not use the vulnerability to access, modify, harm, or otherwise alter any of our (or our customers') data.
Vulnerabilities that are "responsibly disclosed" according to the above process are welcomed. We will not seek to bring legal action against any person who adheres to this process of responsible disclosure. Additionally, severe vulnerabilities are eligible for a vulnerability reward.
You may also contact us with any security concerns, or security suggestions at firstname.lastname@example.org.