Enterprise-Grade
Security Practices
At RevCloud, we combine our Go-to-Market (GTM), CRM, and engineering expertise with enterprise-grade security practices. We treat every client's data with the same rigorous protection we apply to our own.
How We Protect
Your Data
Access Control
All RevCloud personnel utilize secure, individual accounts protected by multi-factor authentication (MFA) across all core platforms, including HubSpot and Microsoft 365. Export of HubSpot or SharePoint data to unmanaged devices is prohibited.
Data Encryption
All client data is protected with industry-standard encryption both in transit and at rest. We utilize protocols such as TLS 1.2+ and AES-256 to ensure data confidentiality.
Data Minimization
We adhere to a policy of data minimization, processing only the information essential to deliver our services. Temporary copies of data are securely deleted immediately upon project completion.
Secure Storage
Client files are stored exclusively within our Microsoft 365 environment (ISO 27001 certified). Client data is never stored on personal or unmanaged devices.
Device Management
We prioritize a secure data environment by never storing client data on unmanaged devices. In cases where client data must be exported to a RevCloud device, clients may request that the device be managed under their company policies via Rippling for enhanced security. For the most sensitive projects, we operate within a client-provided virtual desktop environment.
Standards We
Uphold
GDPR Alignment
RevCloud acts as a data processor and is fully prepared to support our clients in fulfilling requests related to access, deletion, or export of personal data in line with GDPR requirements.
Trusted Suppliers
We partner exclusively with enterprise-grade, certified platforms, such as HubSpot and Microsoft, both of which maintain GDPR and ISO/IEC 27001 certifications.
Retention & Deletion
Data retention periods are clearly defined by project needs and contractual client agreements. All old or unneeded data is subject to a process of secure removal and deletion.
Vigilance &
Accountability
Regular Security Audits
We conduct quarterly audits of all user access permissions and security settings to proactively identify and mitigate risks.
Security Awareness
All team members complete ongoing, mandatory security and privacy training to maintain a high level of awareness and adherence to best practices.
Incident Response Protocol
In the unlikely event of a suspected security breach, we follow a strict incident response plan aligned with ISO/IEC 27001 and GDPR protocols. This includes notifying any affected clients within 72 hours of discovery.