Security

At MarketingMonster, security is our top priority. You trust us with your business data, your payment information and your personal details, and we take that responsibility seriously. We employ a multi-layered security approach that combines industry best practice, strong encryption and continuous monitoring to protect your information from unauthorised access, data breaches and cyber threats.

This document outlines the security measures we have implemented to safeguard your data and ensure the integrity of our platform. It applies to all users, employees, contractors and third-party service providers who access, process or store MarketingMonster data.

Purpose and scope. This policy establishes the minimum security requirements governing MarketingMonster's platform, infrastructure and data-handling practices. It applies to all systems, networks, applications and personnel involved in the processing of user data.

Compliance obligations. We maintain our security programme in alignment with applicable legal and regulatory requirements, including the data protection and privacy laws of the jurisdictions in which we operate. Where contractual or regulatory obligations impose stricter requirements, those requirements take precedence.

Encryption forms the foundation of our data protection strategy. The following controls are applied across our platform:

• All data transmitted between your device and our servers is encrypted using industry-standard TLS. Plain HTTP is redirected, and session cookies are marked secure and are not readable by scripts.
• Sensitive data at rest, including secrets and personal details, is encrypted using AES-256.
• Passwords are hashed with a salt using a purpose-built password hashing algorithm, so they are never stored in plain text and cannot be recovered, even by our team.
• Database connections are authenticated and restricted to our own network, and every query is built through typed drivers with parameterised values, which rules out injection attacks.
• We update our encryption protocols as the standards we rely on change.

We implement strong authentication mechanisms to ensure that only authorised users can access their accounts. This includes:

• Two-factor authentication with a time-based code from an authenticator app.
• Password complexity requirements and rate-limited sign-in attempts to slow down guessing.
• Session management with automatic expiry after periods of inactivity, and server-side invalidation when you sign out or change your password.
• Requests that change anything must come from MarketingMonster's own pages: the server checks the request's origin and rejects cross-site submissions.

Access to sensitive features and data is restricted based on user roles and permissions. We follow the principle of least privilege, ensuring that users, staff and systems only have access to the data and features they need.

Identity verification. Two-factor authentication is available to every account and expected of administrators. User accounts are verified at registration through the email address used to create them, and account changes that affect security settings, such as a new password or a change to two-factor authentication, trigger additional verification steps.

Access review. User roles and permissions are reviewed periodically to ensure access remains appropriate and aligned with the principle of least privilege.

MarketingMonster accepts card and PayPal payments through established payment providers that are PCI DSS compliant. Payments take place on pages hosted by those providers, so your card number, security code and PayPal credentials are entered there and never pass through our servers.

• We receive and keep only what we need to run your account: the amount, the currency, the outcome, the plan and the provider's reference for the transaction.
• Every payment notification a provider sends us is verified against the provider before it is acted on, and notifications are de-duplicated so that a repeated message can never credit a payment twice.
• Your account balance is maintained by a ledger in which every movement is recorded once and only once, so balances cannot be spent twice or fall below what was paid in.
• Transaction data is encrypted and stored securely, and we maintain detailed transaction logs for auditing and fraud prevention.

Third-party provider oversight. Payment providers engaged by MarketingMonster are evaluated for security posture and compliance with industry standards before integration and are subject to periodic review thereafter.

Every tool you open runs in a session created for your account alone, on the server you chose, through a signed per-device key. Sessions are never shared between users and end when you disconnect or the session times out; what we keep afterwards is only that the session existed, never what you did inside it.

• The credentials that give a tool session access to a third-party tool are held on the server and are never delivered to your browser or device.
• Each plan's session and device limits are enforced on the server, and unusual patterns such as many devices or automated access are detected and blocked.
• The desktop application talks to the same authenticated API as the web dashboard, updates itself from signed releases, and does not read your files or browsing outside the application.

Our infrastructure is hosted on secure, enterprise-grade servers with redundant systems and regular backups. We employ:

• Firewalls and intrusion detection systems that monitor and block unauthorised access attempts; nothing in the data layer is reachable from the public internet.
• Rate limits on every public endpoint, including sign-in, registration, password reset and payment, so abusive traffic cannot exhaust the service for everyone else.
• Regular security audits and penetration testing to identify and address vulnerabilities, with findings tracked to closure.
• Automated monitoring and alerting systems that detect suspicious activity in real time.
• Disaster recovery plans that ensure business continuity in case of unexpected events, tested on a regular schedule.

We regularly update our software, systems and dependencies to patch known vulnerabilities and protect against emerging threats. Our development team follows secure coding practices, reviews every change before it ships, and runs an automated test suite that exercises the security-relevant paths of the platform.

Security patches are applied promptly, and we monitor security advisories from vendors and security organisations to stay informed about potential threats.

Vulnerability disclosure. We maintain a responsible disclosure policy. Security researchers and members of the public may report suspected vulnerabilities to [email protected]. Reports are acknowledged and investigated in accordance with our responsible disclosure process, and we do not pursue researchers who act in good faith and give us reasonable time to fix what they found.

We perform regular automated backups of all account data to ensure data integrity and availability. Backups are encrypted and stored in secure, geographically distributed locations.

• Our backup systems are tested regularly to ensure they function correctly.
• We maintain multiple backup copies with different retention periods to protect against data loss, and backups are destroyed at the end of their retention period so that deleted data does not linger.
• In the event of data loss or corruption, we have recovery procedures in place to restore your data as quickly as possible.

While we implement robust security measures, you also play a crucial role in keeping your account secure:

• Use a strong, unique password and enable two-factor authentication. Keep the manual setup key somewhere safe.
• Never share your account credentials with others. One account is for one person.
• Keep your devices, browser and the desktop application updated with the latest security patches.
• Be cautious of phishing attempts and suspicious emails. We never ask for your password by email, and payments only ever happen on our payment providers' pages.
• Always verify that communications are from MarketingMonster before providing any sensitive information, and sign out on shared devices.
• If you notice any suspicious activity, contact us immediately at [email protected].

Review and updates. This policy is reviewed periodically and updated as necessary to reflect changes in technology, regulatory requirements and industry best practice. The most current version is published on our platform.

Enforcement. Compliance with this policy is mandatory for all employees, contractors and third parties with access to MarketingMonster systems or data. Violations may result in disciplinary action, up to and including termination of access or employment, and may be reported to the relevant authorities where required by law.

Approval. This policy has been approved by MarketingMonster's designated security and management authority. Any exceptions to this policy must be formally requested, documented and approved in writing by the authorised approver.

Exceptions. Requests for exceptions to this policy must be submitted in writing to the designated security authority, including a justification, a risk assessment and proposed compensating controls. Approved exceptions are time-limited and subject to periodic review.

Questions regarding this policy may be directed to [email protected].