Faithlife Security
Vulnerability Reporting
Faithlife follows the principles of Coordinated Vulnerability Disclosure. If you believe that you've found a Faithlife-related security vulnerability, please report it by sending an email to security@faithlife.com.
The PGP key for security@faithlife.com can be used to send encrypted email.
Data Privacy
We take the security of your data seriously. Learn more about Faithlife’s privacy policy.
Application Security
In-transit encryption
Sessions between your computer and Faithlife are protected with in-transit encryption using TLS 1.2 or better.
Network firewalls
Faithlife monitors potential attacks with several tools, including network-level firewalling.
Software Development Lifecycle (SDLC) security
Faithlife implements static code analysis tools and human review processes to ensure consistent quality in our software development practices.
Payment Card Industry (PCI-DSS) compliance
Faithlife maintains compliance with PCI-DSS requirements and performs annual and quarterly security assessments on our infrastructure, applications, and personnel.
Datacenter Protections
Physical security
Faithlife products are hosted with infrastructure providers with SOC 2 Type II and ISO 27001 certifications, among others. The certified protections include dedicated security staff, strictly managed physical access control, and video surveillance.
Software Security
Patch management
Faithlife’s patch management process identifies and addresses missing patches within the product infrastructure. Server-level instrumentation ensures tracked software packages use the appropriate versions.
Audits, Vulnerability Assessment, and Penetration Testing
Vulnerability assessment
Faithlife tests for potential vulnerabilities on a recurring basis. We run static code analysis and infrastructure vulnerability scans.
Penetration testing
Faithlife uses third-party penetration testing firms multiple times per year to test Faithlife products and infrastructure.
External audit and certification
Our infrastructure providers maintain ISO 27001, SOC 2 Type II, and many other certifications (AWS) (GCP).