Product security
SSO & 2FA
SAML-SSO (einmaliges Anmelden) ermöglicht es Ihnen, Benutzer in Ihren eigenen Systemen zu authentifizieren, ohne dass diese zusätzliche Anmeldedaten eingeben müssen. Wenn Sie passwortbasierte Authentifizierung verwenden, können Sie die 2-Faktor-Authentifizierung (2FA) aktivieren. Weitere Einzelheiten dazu in unseren Dokumenten.
Permissions
We enable permission levels within the app to be set for your teammates. Permissions can be set to include app settings, billing, user data or the ability to send or edit messages.
Password and Credential Storage
Intercom enforces a password complexity standard and credentials are stored using a PBKDF function (bcrypt).
Uptime
We have uptime of 99.9% or higher. You can check our past month stats at https://www.intercomstatus.com.
Customer Best Practices
There are simple steps you can take to increase the security of your app. Check out the Staying Secure section on our docs site.
Network and application security
Regionales Datenhosting und -speicherung
Die Services und Daten von Intercom werden in Amazon Web Services (AWS)-Einrichtungen in den USA (us-east-1), Dublin, Irland (eu-west-1) und Sydney, Australien gehostet.
Failover and DR
Intercom was built with disaster recovery in mind. All of our infrastructure and data are spread across 3 AWS availability zones and will continue to work should any one of those data centers fail.
Virtual Private Cloud
All of our servers are within our own virtual private cloud (VPC) with network access control lists (ACLs) that prevent unauthorized requests getting to our internal network.
Back Ups and Monitoring
On an application level, we produce audit logs for all activity, ship logs to Graylog for analysis and use S3 for archival purposes. All actions taken on production consoles or in the Intercom application are logged.
Permissions and Authentication
Der Zugriff auf Kundendaten ist auf autorisierte Mitarbeiter beschränkt, die diese für ihre Arbeit benötigen. Intercom wird zu 100 % über https bereitgestellt. Intercom betreibt ein Zero-Trust-Unternehmensnetzwerk. Es gibt keine Unternehmensressourcen oder zusätzliche Privilegien durch die Teilnahme am Intercom-Netzwerk. Wir verfügen über SAML-SSO, 2-Faktor-Authentifizierung (2FA) und strenge Passwortrichtlinien für GitHub, Google, AWS und Intercom, um sicherzustellen, dass der Zugriff auf Cloud-Services geschützt ist.
Encryption
All data sent to or from Intercom is encrypted in transit using 256 bit encryption. Our API and application endpoints are TLS/SSL only and score an “A+” rating on Qualys SSL Labs‘ tests. This means we only use strong cipher suites and have features such as HSTS and Perfect Forward Secrecy fully enabled. We also encrypt data at rest using an industry-standard AES-256 encryption algorithm.
Pentests, Vulnerability Scanning and Bug Bounty Program
Intercom uses third party security tools to continuously scan for vulnerabilities. Our dedicated security team responds to issues raised. Twice yearly we engage third-party security experts to perform detailed penetration tests on the Intercom application and infrastructure. Intercom also runs a ‘bug bounty’ program with Bugcrowd, which gives security researchers a platform for testing and submitting vulnerability reports.
Incident Response
Intercom implements a protocol for handling security events which includes escalation procedures, rapid mitigation and post mortem. All employees are informed of our policies.
Additional Security features
Training
All employees complete Security and Awareness training annually.
Policies
Intercom has developed a comprehensive set of security policies covering a range of topics. These policies are updated frequently and shared with all employees.
Employee Vetting
Intercom performs background checks on all new employees in accordance with local laws. The background check includes employment verification and criminal checks for US employees.
Confidentiality
All employee contracts include a confidentiality agreement.
PCI Obligations
All payments made to Intercom go through our partner, Stripe. Details about their security setup and PCI compliance can be found at Stripe’s security page.