Trust & Security

FunnelCake is a modern Cloud-based architecture built with industry-standard technologies and services, ensuring enterprise-grade security and data protection for our customers.

Data center

FunnelCake's physical infrastructure is hosted and managed within Microsoft's state-of-the-art data centers using Azure technology. Microsoft maintains a robust set of global and regional security certifications, including:

  • SOC1/SSAE 16/ISAE 3402 (formerly SAS 70)
  • SOC 2
  • SOC 3
  • PCI DSS Level 1
  • ISO 9001 / ISO 27001

FunnelCake stores all data within North America (USA or Canada) unless otherwise specified within your agreement.

 

Physical security

FunnelCake's office is located within a secure building where access is controlled both externally and internally. All customer data is in a separate physical location, hosted and managed by Microsoft Azure which has strict physical security parameters.

 

Application

Data storage and processing

  • Multi-tenant data storage and processing
  • Option for single-tenant database and data processing services

Web application

  • Encrypted Sessions 256-bit TLS 1.2
  • Encrypted Cookies for Sessions
  • Strong Authentication
  • Oauth Client Access Protocols
  • Certificate Verification
  • Secure Access and Activity Log
  • Session Timeout
  • URL Access Restrictions

User access management

  • User Credentials encrypted with AES 256-bit encryption 
  • Access/Refresh tokens encrypted with AES 256-bit encryption 
  • User credentials are continuously synced from Salesforce and disabled when Salesforce accounts are frozen or de-activated
 

GDPR

FunnelCake only syncs basic personally identifiable information from Leads and Contacts that is already stored in Salesforce, such as: name, email address, and employer. We rely on your use of Salesforce for the maintenance of this data:

  • If data is added into Salesforce, it is automatically added into FunnelCake at the next sync time.
  • If data is deleted from Salesforce, all associated records are automatically deleted from FunnelCake at the next sync time.
  • Data is automatically rebuilt ever 30 days in case syncing issues arise to ensure we are only looking at the most recent Salesforce data set.

Within the application, end users have access to basic identity information, similar to the access they already have within Salesforce. FunnelCake administrators can choose to limit export functionality from the application, which prevents personally identifiable information from being emailed/stored locally by end users of the application.

FunnelCake does not store any local copies of any customer data. All FunnelCake data is securely hosted and processed within Microsoft Azure through industry standard security mechanisms.

 

Vulnerability reporting

To report a security vulnerability please email security@getfunnelcake.com. For sensitive communication you may use the PGP key listed below. 

Fingerprint
31B8 4820 7135 EF07 F64F 0D57 EF0B 952D 58C8 6298

-----BEGIN PGP PUBLIC KEY BLOCK-----
xsFNBFq0ABwBEADc2zr/ZTkD6211E5Jd3T9cB2scCuBNTXm0HwSbzz/jAB6D
VgCASZTkqvsRRv+M/0uIAPO8Zl7CeKpXMk1kzsgtjXGTREPgiL1fSI8FmADn
fgWxcnhf/vwSWn7yI024Y0d0EKsFvGS/hmH69hpQO4lDQTdm0j1x0wSsIjmG
lCGTAkjov2aXp302RpzVKq5g4StYTMH8reJ5sdYFhk/NUQEveGz35IeX0Xry
rQh0OzArap+ZCyL+5gwPuD7RobmrjmMrDadWWFbmR06+Kv/uyUtyuqefVybu
+6QyTHW3wVsr1XDE924So6FsycrqwcJDFrzRfOUleG/LlVmKa7rma6B8mlRi
Rl0yhh2Y06ByyImT4RAdIf9X6b1hcc64KPCKq1Abnk5U/Wwkc2dzcTDp85KC
XInTgPPtYf316VI9fF0F/eWgd4XfnSUpNJNNYHSL3JQP1H/ePYRWXAa5u+vF
s05lRgyf6H8sH+XbGQ9/PZZ8YZNPc7Ep2z9T+nPEYr9T/3USCfVMddNy3sFY
W4etE3QpY8Aa9OscqIsTmgwnGePC5BzW3nruvAsyxeg2x42+HUp83oc2MewN
rsOs7Vuk2cYeId2Q0BYaBjW9YwyzrQkPUvKM8bttX+jj21xdcclzrWJ4ZOgv
VVARM541qrODxj5QYlPW0adLKlpnsQXsSHTNQwARAQABzSlKZWZmIE1jTWFo
b24gPGptY21haG9uQGdldGZ1bm5lbGNha2UuY29tPsLBdQQQAQgAKQUCWrQA
KgYLCQcIAwIJEO8LlS1YyGKYBBUICgIDFgIBAhkBAhsDAh4BAABTrg/9Fq0i
YEJT9zo+yOAC7Sc5I4SQnruFNl0+fbUcfpcv1qviYgXvxEzQ33NZGje9lSKO
6gMbeuAUDd8RbOQ5O8Q8D/K28urKRcrU/t02logyGy+pYh56evNc/rcF6L9G
83qIthS3N4dzJqyq4XckcviD7LgMueDkjz66ki9Kg43SR7Do9US95SSE1YJ/
Ul8iKv9M42/PVzQaZdCnbJWJPeM3QaHLMEHWiMrcEtwWlRm2cgUccP+qkZnm
RGUm7nlHuw6xTfRqlvuNjER8LVveDujr2TYYQoONdOBdIBrSmpVpqPmdLfX0
hllDiPD1mdiXhD8RzCQA7ezaRPBfV/BLGRjValMuCQbDDbKNU8MdXKEt8zYG
/O6Kq5wYfHnU/ikmrSQTOcElsBIQJC3bJ4IvoxHv7JQU/+AFthYm/JG9ptyQ
dpk/T6a0KliqhTf/Do+SRMiByCq27HvUFgM5vFypqINz55/Mco2Km8lgBYps
fbvXlGvDxDUa2GDNrKFoQsqYE5OUEHqUFcfYOY8PpNqewVLFIlT6R3QgS3jv
hUruGGzm2JNIodMv0a7LO7WEhZUvX6eIIeZi0aObj/aP4tZ0zCDwac+xssvl
5jU0cgrdW9kLTtsnHUpGmGYSOXSvQpEQ5HMq0v/5VhwxgLOUptJVhXlFdYg/
1LvVhfvG9K35nceDevLOwU0EWrQAHAEQAMc3SzfF9L4McQztrWc8Da9evVE0
JLzHYrU2TtZIWZYOmixFAKKz9HuQtXcKxp5F2bgAdXaBjEJLFkLpvwcPiTB6
ZdGUgwzqEd8lDeS7Bm9VqqCugEbw/25WwyRhrsmKbrv4QBciuCcE9tOn6zaw
bJ9CRXCF346/Dqfx1m7NkXboEBWYjCy677yBu7XqGa9x4Cxp77yzFCALzb8H
i1/c3YII2vHRkohIL72lW3CP7uoi0o4On/SbdRtPN6FbdNIorPLol/+H7e3a
hXtWZVIG/hvvrlDjp2frLhPwvEQfrqGCSbgfMFVVBFnxZvRAVg1rnpjkO6TC
mc3Qob0w9QfNfKNXepDBbjAv+7FoU22A8DKAiCRCEJDVGM6u9DSgSutKLPsm
TbDNoa9odz1TVj0KaxSl+kwiUC9KeGEyfz3QnfamNFBcp41osRmaGRt60qVB
apNu+8Hx+kcclrIne/9Hj++CQ2ge5Eo2w2/sXQEXsi4TVE/UPO2IE8hSw+mu
xTW+yljx8Io286TbocspAQF0bA+5aYYPGYjQB/Z5YOLKRIA1oXdZvBAWKNUy
172yJPz4vwb1IHGgBE9xQ8He+wne+QLdvOW0RwMUyosA4jBYG70tQ8NBb0+a
YPErFxGYeLinC/gk/z8e8VuKIWno83TZnX/VrUwMnpgE66h1KcnZOq1FABEB
AAHCwV8EGAEIABMFAlq0ACsJEO8LlS1YyGKYAhsMAAC9zRAAg4AeIgIkKU2+
qRQkx2UXBd62jfmjs3941Pv4MnjzDCNGPp//DdEfjVzzTwQPavzejhdueslo
towyyJZJN5iPx+Ks+iIMBX1PINGxQklwsY/v3/fWidRhkMVeA+Y4gHKsOb7V
52NI5P/b8n7Llg6MGsSz98STcdAHeyN4PiVDNrijBzmSTOo0HFVniS/vmp5Y
dioT/VRtWInj5LdRVIUYrL1KKYY3zGmRV29OqKI0fS8/iVontxBfmi5+rv3n
n/UHk8K7S4jxTmwjvDfBbHviHGXt1RhjTdJR412ibUHBkL77mgQimo731LqU
W00XGYl1VqbxwgvCjifi2WB2kFgr4RbGzideFIonuTIdn1XfYCe0SRYCCfea
GpFDHnkCrf8Zibq8MrYw1tSFqR7Zy1PKmz0TRqptWvU7WMwCSW+qY0usNPiQ
WNYmYgKpU4k+PU/05MLFNXWZXA2UEjCizpl7H50ek++6Frbw1TlPVfcFtJOy
b5SfUh/DUXcex/Kl9G83sOzSRl9dYdnKwL5cJL0USbj+u5iBu7Gdxqekb0SN
4xhW7TKOIFAMDT3Piq+loYLSbcz0LjPnQZqmB5trn4ERnrbYVnmCkzbpbLkl
mhjDq/K+NIj5Tgbudtk27cnEsYBJP2PVnbK1SkvY4aAVsYbCaniRTJo7A3D2
a5dU6zDNftU=
=xMeJ
-----END PGP PUBLIC KEY BLOCK-----