How is data security handled in Chargebee?

Problem Statement

This article helps you understand how is data security handled in chargebee.## Scope

• What are the security and compliance provided by Chargebee?
• Is Chargebee certified with all the standard security policies?

Solution

At Chargebee, we take security very seriously and we continuously look for opportunities to make improvements.

Here's the list of security measures that we have currently covered:

PCI Compliance

The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard administered by the PCI Security Standards Council, which was founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa Inc.

PCI DSS applies to all entities that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD), including merchants, processors, acquirers, issuers, and service providers. The PCI DSS is mandated by the card brands and administered by the Payment Card Industry Security Standards Council.

Chargebee ensures that your customer's sensitive card information is encrypted and handled in a safe and secure manner. With annual audits and PCI-DSS Level 1 certification, Chargebee protects sensitive data.

ISO 27001:2022

ISO 27001 (formally known as ISO/IEC 27001:2022) is a specification for an information security management system (ISMS). An ISMS is a framework of policies and procedures that includes all legal, physical and technical controls involved in an organization's information risk management processes with the aim of keeping information secure.**

Chargebee is ISO 27001:2022 certified and we're committed to identifying risks, assessing implications and putting in place systemized controls that inspire trust in everything that we do - right from our codebase to physical infrastructure to people practices.

SOC 1 and SOC 2 attestation

The SOC attestation ensures that SaaS service providers such as Chargebee securely manage your data to protect the interests of your organization and the privacy of its clients. SOCs for Service Organizations is internal control reports on the services provided by a service organization providing valuable information that users need to assess and address the risks associated with an outsourced service.

The purpose of these reports is to help you and your auditors understand the Chargebee controls established to support operations and compliance. There are two SOC Reports of Chargebee that you can get on-demand:

1. Chargebee SOC 1 type II report
2. Chargebee SOC 2 type II report

For more details about our SOC 1 and SOC 2 attestation, you can reach out to support

GDPR

The General Data Protection Regulation (GDPR) is a European privacy law that became enforceable on May 25, 2018. The GDPR replaces the EU Data Protection Directive, also known as Directive 95/46/EC, and is intended to harmonize data protection laws throughout the European Union (EU) by applying a single data protection law that is binding throughout each member state.

The core of Chargebee's internal operations underpins protecting the personal data of our customers. We only collect and store information that is necessary to offer our service, and we do this with the consent of our customers. Adding to this, our approach towards privacy, security, and data protection aligns with the goals of GDPR.

HIPAA Compliance

Health Insurance Portability and Accountability Act (HIPAA) is made up of a set of regulatory standards governing the security, privacy, and integrity of sensitive healthcare data called protected health information (PHI).

Chargebee provides SAAS solutions that cater to various customers including Healthcare merchants and we enable our customers both covered entities and business associates to successfully meet HIPAA requirements. We have established necessary safeguards in the below domains to protect ePHI (electronically protected health information) that is collected, accessed, processed, and stored.

Host Security

SSH keys are required to gain console access to our servers and each login is identified by a user. All critical operations are logged to a central log server and our servers can be accessed only from restricted and secure IPs.

Access to Audit trails and logs is restricted to authorized personnel based on roles and responsibilities. Segregation of duties is implemented to restrict the system administrators from accessing and modifying log files. Security measures are implemented to secure the audit log files from unauthorized/unintentional modifications through AWS IAM Policy.

Vulnerability Scanning & Patching

We periodically check and apply patches for third-party software/services. As and when vulnerabilities are discovered we apply the fixes. We do periodic vulnerability scanning using the services of an authorized QSA.

Chargebee performs the VAPT assessment on a quarterly basis.

In addition, we also have an in-house security team who performs Vulnerability scans on a monthly basis.

Governance, Risk, and Compliance (GRC) and Privacy:

We have a dedicated team working on various GRC and Privacy initiatives and the team is responsible for managing the organization's overall governance, enterprise risk management, compliance, and Data privacy regulations. The objective of the GRC and Privacy team is to enable a structured approach to align IT with business objectives, while effectively managing risk and meeting compliance & data privacy requirements.

• Internal audit

• Risk Assessment

• Physical and Network Security

• Administrative Operations

• Host Security

• Monitoring

We use both internal and multiple external monitoring services to monitor Chargebee. Our monitoring system will alert the Operations & Security Team through emails and phone calls if there are any errors or abnormalities in the request pattern.

Data Storage & Redundancy

Chargebee has developed a formal Business Continuity Plan (BCP) to minimize disruption to critical services in times of crisis and to maintain a higher degree of resilience. Business Impact analysis is performed to identify critical operations, processes, and facilities. Crisis roles and responsibilities are defined as part of the BCP. The BCP and DR plan of Chargebee are reviewed and audited as part of ISO 27001 standards and SOC 2 Type II covering availability as one of the trust service criteria.

Click here for more information.