Explains the security measures, practices, and safeguards Siteligent implements to protect customer data, systems, and Services.
Security Policy
1. Introduction
This Security Policy describes the security practices, controls, and safeguards implemented by Siteligent to protect the confidentiality, integrity, and availability of our Services and the information entrusted to us by our Customers.
Security is a fundamental part of how Siteligent designs, develops, and operates its platform. We continually review and improve our security program to address evolving technologies, threats, industry standards, and legal requirements.
This Security Policy applies to the Siteligent platform, supporting infrastructure, personnel, subprocessors, and operational processes used to provide the Services.
This Security Policy should be read together with our Privacy Policy, Data Processing Agreement (DPA), Terms and Conditions, and Subprocessors page.
2. Security Principles
Siteligent’s security program is built upon the following core principles:
Defense in Depth
We implement multiple layers of technical, administrative, and organizational safeguards designed to reduce security risks and protect Customer information.
Least Privilege
Access to systems, infrastructure, and Customer information is granted only to authorized personnel who require such access to perform their responsibilities.
Customer Isolation
The Services are designed to maintain logical separation between Customer environments, helping ensure that each Customer can access only their own authorized information.
Secure by Design
Security is incorporated throughout the design, development, deployment, and maintenance of the Services, with security considerations integrated into our development and operational processes.
Transparency
We strive to communicate openly about our security practices, subprocessors, incident response procedures, and privacy commitments.
Continuous Improvement
Our security controls are regularly reviewed and updated to reflect changes in technology, industry best practices, emerging threats, and applicable legal requirements.
3. Infrastructure Security
Siteligent operates its Services using trusted cloud infrastructure providers and implements multiple layers of infrastructure security designed to protect Customer information and maintain service availability.
Our infrastructure security practices may include:
- Secure cloud hosting environments.
- Network segmentation and access controls.
- Content delivery and network protection.
- Distributed denial-of-service (DDoS) mitigation.
- Web application protection.
- Secure Domain Name System (DNS) services.
- Infrastructure monitoring.
- Security logging.
- Secure configuration management.
- Redundant infrastructure where appropriate.
Production, testing, and development environments are maintained separately to reduce operational risk and help protect production systems and Customer information.
Access to production systems is restricted to authorized personnel and protected through appropriate authentication, authorization, and access management controls.
4. Encryption
Siteligent uses industry-standard encryption technologies and security practices designed to protect Customer information during transmission and storage.
4.1 Encryption in Transit
Data transmitted between Customers, connected services, and the Siteligent platform is protected using industry-standard transport encryption.
Secure communication protocols are used to help protect data against unauthorized interception or modification while in transit.
4.2 Encryption at Rest
Where appropriate, Personal Data, authentication credentials, API credentials, backups, and other sensitive information are protected using industry-standard encryption technologies while stored.
Storage providers engaged by Siteligent are expected to implement appropriate security controls designed to protect stored Customer information.
4.3 Key Management
Encryption keys, authentication secrets, and other sensitive credentials are managed using secure key management practices with access restricted to authorized systems and personnel.
Siteligent periodically reviews and updates its key management procedures as part of its overall security program.
5. Authentication and Access Control
Siteligent implements authentication and access control measures designed to ensure that only authorized individuals can access Customer accounts, systems, and information.
5.1 Account Security
Account authentication is protected through secure authentication mechanisms designed to safeguard Customer accounts.
Customers are encouraged to:
- Use strong, unique passwords.
- Enable multi-factor authentication where available.
- Keep account credentials confidential.
- Promptly report suspected unauthorized access.
5.2 Access Controls
Access to production systems and Customer information is limited to authorized personnel who require such access to perform their responsibilities.
Access permissions are granted according to the principle of least privilege and are reviewed periodically.
Administrative access is protected through additional security controls appropriate to the sensitivity of the systems being accessed.
5.3 Session Security
Siteligent implements session management controls designed to help protect authenticated sessions from unauthorized use.
These controls may include secure session handling, session expiration, authentication validation, and other appropriate security measures.
5.4 Customer Environment Isolation
The Services are designed to maintain logical separation between Customer environments.
Access controls are implemented to help ensure that Customers can access only the information and resources for which they have been authorized.
6. Data Protection
Siteligent applies technical and organizational measures designed to protect Customer information throughout its lifecycle.
These measures may include:
- Data minimization practices.
- Access controls.
- Secure processing procedures.
- Security monitoring.
- Controlled administrative access.
- Secure handling of authentication credentials.
- Secure deletion practices.
- Protection against unauthorized disclosure or modification.
Siteligent processes only the information reasonably necessary to provide, maintain, secure, and improve the Services.
Where AI-powered features are used, Siteligent is designed to minimize the information shared with AI providers. AI processing is limited to the information necessary to deliver the requested functionality and is governed by our Privacy Policy.
7. Backup and Disaster Recovery
Siteligent maintains backup and recovery procedures designed to support the availability and resilience of the Services.
Our practices may include:
- Scheduled backups.
- Encrypted backup storage.
- Geographically distributed storage where appropriate.
- Recovery procedures.
- Periodic testing of backup and recovery processes.
- Business continuity planning.
Customers may choose to use Siteligent-supported backup storage or connect supported third-party cloud storage services, depending on the functionality available within the Services.
Disaster recovery procedures are reviewed periodically to help ensure the continued availability and reliability of the Services.
8. Monitoring and Logging
Siteligent maintains monitoring and logging practices designed to help detect, investigate, and respond to security events, operational issues, and platform performance concerns.
Our monitoring and logging practices may include:
- Security event monitoring.
- Authentication and access logging.
- Infrastructure monitoring.
- Error and performance monitoring.
- System health monitoring.
- Audit logging for administrative activities.
- Detection of suspicious or unauthorized activity.
Access to security logs is restricted to authorized personnel with a legitimate business need.
Log retention periods are determined based on operational, security, legal, and regulatory requirements.
9. Vulnerability Management
Siteligent maintains a vulnerability management program designed to identify, assess, prioritize, and remediate security vulnerabilities affecting the Services.
Our practices may include:
- Regular security assessments.
- Automated vulnerability scanning.
- Dependency and software component monitoring.
- Security testing during development.
- Risk-based prioritization of identified vulnerabilities.
- Timely application of security updates and patches.
Security vulnerabilities are evaluated based on their severity, potential impact, exploitability, and associated risks.
Where appropriate, Siteligent may engage independent security professionals to perform security assessments or penetration testing.
10. Incident Response
Siteligent maintains incident response procedures designed to identify, contain, investigate, remediate, and recover from security incidents affecting the Services.
Our incident response process may include:
- Detection and assessment.
- Containment.
- Investigation.
- Remediation.
- Recovery.
- Post-incident review.
Where a security incident results in a Personal Data Breach, Siteligent will notify affected Customers without undue delay where required by applicable law or contractual obligations.
Following significant security incidents, Siteligent reviews the incident to identify opportunities for improving its security controls, operational processes, and response procedures.
11. Employee Security
Siteligent limits access to Customer information and production systems to authorized personnel who require such access to perform their responsibilities.
Employee security measures may include:
- Role-based access controls.
- Confidentiality obligations.
- Security awareness training.
- Secure onboarding and offboarding procedures.
- Periodic review of access permissions.
Personnel with access to Customer information are expected to follow Siteligent’s internal security policies and maintain the confidentiality of Customer information.
12. Compliance
Siteligent designs its security program to support compliance with applicable privacy and data protection laws, including, where applicable:
- General Data Protection Regulation (GDPR).
- UK General Data Protection Regulation (UK GDPR).
- India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
Our security controls are reviewed periodically and updated as our Services, technologies, regulatory obligations, and industry best practices evolve.
13. Customer Responsibilities
Security is a shared responsibility between Siteligent and its Customers.
Customers are responsible for:
- Maintaining strong account credentials.
- Enabling multi-factor authentication where available.
- Managing user accounts and permissions appropriately.
- Securing connected WordPress websites and infrastructure.
- Protecting API keys, authentication credentials, and access tokens.
- Reviewing connected third-party integrations.
- Promptly reporting suspected security incidents or unauthorized access.
Customers are responsible for maintaining appropriate security practices within their own environments and for ensuring that authorized users comply with their internal security requirements.
14. Responsible Disclosure
Siteligent welcomes responsible disclosure of security vulnerabilities by Customers, researchers, and the security community.
If you believe you have identified a potential security vulnerability affecting the Services, please report it through our support channels with sufficient information to allow us to investigate the issue.
We ask that security researchers:
- Act in good faith.
- Avoid disrupting the availability or integrity of the Services.
- Do not access, modify, or disclose information belonging to other Customers.
- Comply with applicable laws throughout any security research activities.
Siteligent will review legitimate vulnerability reports, investigate verified issues, and take appropriate remediation measures.
Good-faith security research conducted in accordance with this policy will not, by itself, result in legal action by Siteligent.
15. Policy Updates
Siteligent may update this Security Policy from time to time to reflect changes in our Services, security practices, legal obligations, or industry standards.
Material updates may be communicated through email, dashboard notifications, website announcements, or other appropriate communication channels.
The latest version of this Security Policy will always be available on this page.
16. Contact Us
If you have questions regarding this Security Policy or wish to report a security concern, please contact us at:
Email: support@siteligent.com
We encourage Customers to report suspected security issues promptly so they can be investigated and addressed as quickly as reasonably possible.