Overview

Cast Security Essentials Overview

At Cast, security is a top priority. Cast customers trust us with a significant amount of data, and we do not take this responsibility lightly.

To earn our customers’ trust, we handle data with the utmost care and integrity. Whether it’s encrypting your data over the Internet and at rest or using 2FA, we want you to have confidence in how your data is being collected, transported, and stored.

We frequently get questions that fall into a handful of major groupings surrounding your data and who has access to it. These are the same questions we ask of third-party services handling our data, so we appreciate that you’re asking. We’re hopeful that our answers in this document will give you a better view into the exact mechanics we use to secure your data within our internal systems.

Securing data in transit

Cast acts as a routing and processing layer for your data. That means data goes through three distinct phases: 1. Data is collected via our data sources 2. Data is routed and transformed inside the Cast infrastructure via the Cast Designer 3. Data is then presented via Casts.

Let’s go through each portion in turn.

Cast collects your data from one of its 50 data sources, from Salesforce, Redshift, Google Sheets, and more. Data from these data sources are collected via Data Source integrations that run on your behalf in the Cast Designer. In order to collect this data, you must OAuth with the Cloud app vendor and grant Cast-specific access to the tools. In cases where Cloud apps do not support OAuth, we will ask you to grant Cast access via API keys. Both application Sources and Cloud app Sources can be configured to send data securely to our TLS endpoint.

Data routed within Cast’s infrastructure

Data routed within our infrastructure happens inside a Google Virtual Private Cloud (VPC). It is transferred within a private subnet that is inaccessible from the public Internet. At the final stage of the data pipeline, data is transmitted from a public exit node to the configured destinations.

Aside from our bastion nodes and our pipeline exit nodes, only instances inside the VPC are able to access one another. Public-facing servers as part of our API, CDN, or Web app all receive traffic through public load balancers managed by Google.

Securing data at rest

There are two core types of data that Cast manages: 1) metadata related to API keys and authentication, and 2) data, which is collected via our 50 data sources. Metadata is securely stored long term in internal Cast databases, separate from customer data you send. Customer login passwords for the Cast application are salted and hashed using the industry standard bcrypt. All metadata is backed up throughout the day to avoid data loss and service disruption. Cast only saves query results in a cache from the 50 data sources or any data that is sent in a Cast. The customer can elect to have this data deleted at any time.

Securing data access

From a customer perspective, there are several ways of managing access to your data. Access to this data is controlled via the Cast Designer and we provide customers the ability to manage this access on a per-user level.

If you have granted a user access to your Designer as an owner, they may modify the downstream settings for any data source within that team’s instance. If a user has only been granted access as a collaborator for a single data source, that person can only make modifications to that data source, and to the integrations for the data coming from that data source.

Our customers can also grant read-only access. Read-only members can view any data, but they cannot create or modify any Sources or integrations. Read-only members can also view Workspace settings but cannot modify any settings.

On Cast’s side, members of the engineering team have access to your data for debugging purposes only. The following safeguards are in place to ensure this access is strongly protected:

1. All production access is federated through SSH and IAM.
2. Authorized employees gain access to the environment through our external bastion nodes. Access is gained utilizing per employee SSH keys and a second factor.
3. In order to perform administrative actions, users must use multi-factor authentication (MFA) to authenticate with our identity provider and obtain temporary credentials.

Continuous monitoring and updating

Google Cloud Services (GCP) serves as the front line of protection for all network-level attacks, like DDoS. GCP manages the software and selection of cipher suites on our load balancers and will automatically flag and block malicious behavior. To ensure that Cast adheres to security best practices, we maintain relationships with our vendor security consultancies, who perform regular application-security assessments on our highest-risk applications. Critical vulnerabilities are handled within 1 business day. We actively monitor GCP audit logs on all administrator actions

across each GCP account. Security alerts stemming from these sources are monitored and acted on by our team.

In alignment with Cast’s commitment to the privacy and protection of customer and corporate data, we have developed a comprehensive Information Security and Privacy Program (ISPP).

The Cast ISPP is continually enhanced to align with new and evolving regulatory requirements such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

When it comes to security, our focus at Cast never wavers, and our teams devote themselves to its practices to ensure the privacy of your data.

Appendix of Security and Privacy measures taken by Cast

1. 2-Step Verification Enforcement
   All account and infrastructure access utilizes 2 step verification to greatly reduce the risk of unauthorized access by asking Cast employees for additional proof of identity when signing in.
2. Identity and Access Management (Cloud IAM)
   Cast employee access is controlled against unauthorized access by controlling access rights and roles for all databases, servers and services we use.
3. Data Loss Prevention Service
   We use a data and deployed code loss prevention service that discovers, classifies, and de- identifies data to help meet the principles of data protection by design and by default.
4. Logging and Monitoring
   Logging, monitoring, alerting, and anomaly detection systems are integrated into Cast stack to give us the information necessary to assist any GDPR needs quickly and effectively.
5. Access Transparency
   Cast has near real-time logs when our administrators access your content.
6. Security Scanner
   We scan for and detect common vulnerabilities in our applications to prevent potential threats to the ongoing confidentiality, integrity, availability, and resilience of our applications.
7. Security Command Center
   We view and monitor an inventory all of our assets, scan storage systems for sensitive data, detect common web vulnerabilities, and review access rights to our critical resources from a single, centralized dashboard.
8. Network security
   We secure the network to enforce our network perimeter and allow for network Castation,

remote access, and DoS defense. These include: Load Balancing, Encryption in transit, and Application Layer Transport Security.

9. Suspicious Login Monitoring
We prevent and protect against unauthorized access by detecting suspicious logins using robust machine learning capabilities.

10. Enhanced Email Security
We require email messages to be signed and encrypted using Secure/Multipurpose Internet Mail Extensions (S/MIME), ensuring appropriate security, confidentiality, and integrity of personal data.

11. Information Rights Management
We disable downloading, printing, and copying of sensitive files from our servers.

‍