Whova Security & Reliability Guide

We take security and compliance seriously

We are fully committed to keeping your data and your attendees’ data safe. That’s why some of the world’s leading companies trust us.

​

• SOC 2® Type 2 compliance is part of the American Institute of Certified Public Accountants’ System and Organization Control reporting platform. It covers security, availability, processing integrity, confidentiality, and privacy of customer data.
• The SOC 2® Type 2 report recognizes Whova’s practice of reliable, safe, secure, and trustworthy management of customer data protection and privacy.
• Whova is committed to delivering a secure Event Management Platform that meets our customers’ regulatory and compliance obligations.

• Whova complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.
• Whova is compliant with the General Data Protection Regulations (GDPR).
• Whova is committed to addressing complaints about how we handle personal data under the DPF.
• Whova does not sell the personal information of our customers to third parties.
• We have a full-time legal and security team focused on privacy and security issues.
• More details about the privacy terms can be found here.

• Whova is committed to protecting consumer credit card data in compliance with the Payment Card Industry Data Security Standard (PCI DSS).
• Our alignment with this standard is reflected in the people, technologies, and processes we employ.
• We conduct regular vulnerability scans and penetration tests in accordance with the PCI DSS requirements for our business model.
• Whova’s payment processor Stripe complies with PCI 3D Secure. More details are here.

• All data in transit is encrypted with the strongest industry-standard cryptographic protocol SSL so all connections between networks and servers are secure.
• Whova’s SSL certification is renewed every year.
• No credit card information is stored in Whova after transaction authorization.

• Whova’s servers and data centers are physically located in USA and hosted by the world’s leading high-security cloud systems provided by Amazon Web Services (AWS).
• AWS has certification for compliance with ISO/IEC 27001:2013, 27017:2015, 27018:2019, and ISO/IEC 9001:2015 and CSA STAR CCM v3.0.1.
• PCI-DSS Level 1 Service Provider
• SAS-70 Type II and SSAE16
• For more details, please visit the AWS security site and AWS PCI compliance site.

• Whova complies with the EU-US Privacy Shield framework for the collection, use, and storage of personal information transferred from the EU and Switzerland.
• Whova does not sell the personal information of our customers to third parties.
• Our dedicated legal and security team works full-time to ensure the highest standards of privacy and security.
• More details about the privacy terms can be found here.

• Uptime: our service is on the most reliable cloud platform, Amazon Web Services (AWS), and the uptime will always be at least 99.95% based on AWS SLA.
• We use various internal tools to further monitor availability and performance 24×7.
• We maintain your data with an automatic backup system running all the time and ensure the availability and safety of your data.
• Disaster recovery: we have a step-by-step plan to ensure our services and customer data are protected and recoverable in the event of a disaster.

• Whova distributes the app through the official app distributors, Apple App Store and Google Play Store, and an HTML5 application
• All applications are regularly scanned for common security vulnerabilities
• All Whova engineers are required to attend the training sessions on code security
• All web and mobile applications are primarily developed, tested, deployed, and maintained by a full-time, in-house engineering team.
• Whova works with the world’s top security research group and published a research paper with the most prestigious international security conference, “the 2019 ACM SIGSAC (Special Interest Group on Security, Audit, and Control) Conference”

• Whova has a dedicated in-house security team to monitor threats and respond to security alerts.
• Whova monitors security system alerts 24×7 and is ready to respond to incidents at any time.
• Whova maintains and regularly tests our incident response plan in case of any breach of Whova’s data system.

• We perform regular internal scans and penetration tests for vulnerability detections. Once identified, their fixes are treated as the highest priority.
• Whova delivers a security code training program to every new engineer.
• All employees are required to sign Non-Disclosure and Confidentiality agreements.
• Whova offices are secured by keycard access, and they are monitored with cameras 24×7.
• We continuously train employees on best security practices, including how to identify social engineering, phishing scams, and hackers.

• Do not attempt to harm Whova, its users, or its customers’ data.
• Allow a reasonable time for Whova to investigate and resolve the issue.
• Please don’t share the vulnerability you discovered publicly. Instead, please report details to security@whova.com, including steps to reproduce.
• Please use the PGP key at the bottom of the page to encrypt your message sent to security@whova.com.

Trusted by the World’s Leading Brands and Organizations