Overview
Branch provides an industry leading mobile linking and measurement platform that unifies user experiences and attribution across devices, platforms, and channels. We understand the inherent risks of operating our Service in a digital landscape where cyber attackers are looking for opportunities to compromise data.
We operate our Service under a shared responsibility model by which the responsibility for certain security and compliance elements is shared between us and our customers. We provide appropriate technical and organizational measures to ensure the security and privacy of the Service infrastructure.
You are responsible for your implementation of the Service and configuration of the security, privacy, and retention settings within the Service.
If you can control a parameter within the Services, then you are responsible for ensuring it is configured to meet your compliance needs.
This shared responsibility model enables us to provide you with a Service that can be configured to empower our most security conscious customers to enhance their end users' experience and improve measurement performance across their business.
Our commitment to providing a secure experience for our customers works in tandem with your responsibility for adhering to certain standards and practices as a subscriber to the Service as further outlined below.
Access controls and configuration
Branch's responsibilities
- Promote and maintain robust security and privacy measures within the Service to protect the confidentiality, integrity, and availability of data which includes the maintenance and configuration of Branch's Software Development Kit (SDK), cloud infrastructure, and the operating software deployed on its cloud infrastructure.
- Maintain secure system access for its personnel, including role-based security access, with multi-factor authentication and password access control.
- Provide multiple security controls and settings that can be configured by customers to address their security needs.
Your responsibilities
- Implement the Service and configure appropriate controls in line with Branch's Documentation, acceptable use guidelines, and industry leading security practices or your own internal security policies.
- Assign proper roles and permissions to authorized users, along with robust user provisioning processes that incorporate the principle of least privilege, to ensure that authorized users only have the minimum access necessary to perform their pre-specified duties.
- Implement and enforce secure authentication (e.g., SSO, MFA) on customer-managed interfaces.
Maintain and configure your own mobile applications, marketing materials, websites, and other assets or digital properties that you deploy the Service in.
Privacy and data security
Branch's responsibilities
- Conduct security vulnerability scanning and penetration tests on the cloud environment and employ system monitoring tools to detect system events for suspicious activity.
- Patch and repair flaws within the cloud infrastructure, the operating software deployed on its cloud infrastructure, and the SDK it makes available to customers.
- Maintain a security incident response program that is tested regularly.
- Perform third-party security assessments and audits.
- Protect data from external threats through appropriate cloud security controls including the encryption of data at rest and in transit over public networks.
- Provide an additional level of data protection with field-level encryption for customers utilizing the Advanced Compliance Service.
- Maintain a range of industry standard third-party audit certifications available at https://www.branch.io/security.
- Maintain a documented data privacy statement that describes what data Branch collects, how it is used, and how it is shared available at https://branch.io/privacy.
- Provide routine security awareness and privacy training to Branch personnel.
- Comply with laws and regulations applicable to Branch's provision of the Service.
Your responsibilities
- Ensure that any data uploaded to the Service complies with applicable laws and regulations, Branch's Acceptable Use Policy, and industry best practices.
- Implement internal policies and guidelines designed to protect data processed through the Service and provide routine security awareness and privacy training to personnel.
- Understand where data may be shared with a third party through an integration or other optional configuration, and treat such channels or configurations in accordance with your security policies and approved use cases.
- Monitor all activity within your instance of the Service including timely review of audit logs.
- Notify Branch immediately when you become aware of, or suspect that a security vulnerability exists, or that a data breach or security incident involving the Service has occurred or is likely to occur.
- Promote the secure deployment and maintenance of all third-party integrations you configure within the Service and ensure continuous monitoring and incident response on customer and third-party integration assets.
- Maintain and apply security updates, patches, and fraud detection and prevention measures to your own infrastructure used to access the Service.
Additional resources
Please visit the pages below for more information about the topics mentioned above.
Branch Help Center
- Branch Quick Start Guide
- User Permissions and Management
- Data Privacy
- Data Integration Implementation Guide
- Data Integration Partners
- Fraud Prevention
- Account Settings