Security at Airtable

·Security at Airtable

·Prioritizing the Protection of Your Data Security at Airtable 1

·Table of Contents

·Airtable overview

·Airtable is a real-time, collaborative database with a spreadsheet-like interface that enables end users to create and organize content for purposes such as project management, sales tracking, or inventory records. Airtable provides client software across multiple platforms, including web, iOS, Android, Apple OS X, and Microsoft Windows. Essential to the Airtable product experience is a fully managed cloud backend, which communicates with the Airtable software clients, enables real-time collaboration features, and securely stores customer data.

·Airtable was founded on the belief that software shouldn't dictate how you work-you should dictate how it works. Our mission is to democratize software creation by enabling anyone to build the tools that meet their needs.

·Airtable has office locations spread out across the United States of America and an office in Europe.

·Culture of Security

·At Airtable we believe that protecting the customer data is an integral part of who we are as an organization. To this end, our team of dedicated security practitioners, working in partnership with peers across the company, take exhaustive steps to identify and mitigate risks, implement best practices, and constantly mature our security practices.

·Security program

·Airtable maintains an Information Security Management System (ISMS). We strive to develop a program that protects the confidentiality, integrity, and availability of the data. Airtable's program leverages a host of network and endpoint security tools to prevent unauthorized access to customer data. We have developed information security policies, updated at a minimum on an annual basis, on categories such as access control, risk management, change management, incident response, and others.

·Our security program aligns with SOC 2 Type 2 and ISO 27001 guidelines. Airtable is certified for both and the certifications can be provided upon request by contacting sales@airtable.com.

·People security

·Airtable takes a thorough approach to ensuring our organization maintains strict standards as it pertains to hiring and staffing with the right people. As part of Airtable's approach to personnel security, employees are required to undergo background checks prior to employment. Additionally, employees are required to sign and comply with a code of conduct and all Airtable policies. Airtable conducts formal evaluations for employee performance and consistent alignment with company objectives. Employees that do not comply with our policies are subject to sanction procedures and disciplinary actions. Security-Focused Organizational Culture Security Tools Technology Global Information Security Policies IT Security Audits

·Protecting Customer Data

·Endpoint security

·Airtable does not store customer data on company workstations, laptops, or removable media. Customer data is stored only in the production environment.

·Airtable production systems are closely controlled. Company devices are proactively managed throughout the entire device lifecycle. Our device management solution ensures all workstations are configured with antivirus and anti-malware, and they are updated daily.

·All workstations are configured with a strong user password, screen lockout policies, and are restricted for use only for operations-related tasks. Airtable uses full-disk encryption for our laptop fleet. As an additional safeguard, when computers are no longer needed, they are securely wiped using a NIST 800-88 compliant process or destroyed. Airtable employees are not allowed to use mobile devices on the production network for performing any Airtablerelated work.

·Airtable enforces mobile device management (MDM) policies on all companyissued devices to ensure encryption, endpoint protection, secure configuration, and remote wipe capabilities in the event of loss or compromise.

·Network security and server hardening

·Customer data is logically segregated and encrypted at rest and in transit. We follow an industry-standard practice for cloud SaaS providers by using a multi-tenant database. Airtable is hosted in Amazon Web Services (AWS). Physical and environmental security for AWS's data centers is described in the AWS Security Whitepapers.

·Airtable's production environment uses AWS best practices for network segmentation and for protecting our internet facing services. Airtable utilizes security groups and firewalls for added network traffic security. Airtable utilizes separate AWS accounts for its development, staging, and production environments.

·Airtable leverages a commercial Web Application Firewall (WAF) as part of its defense-in-depth strategy to detect malicious activity. Airtable establishes and maintains comprehensive network security measures, including intrusion detection/prevention mechanisms to identify and block potential security attacks from outside the boundaries of the system and data loss prevention (DLP) capabilities to restrict unauthorized data exfiltration.

·Airtable has a documented hardening process for all network devices, servers, and software. All our systems, including cloud systems, are configured according to these standards. When building new servers, we harden the Operating Systems (OS) using steps such as:

• ·Launching new machines in a protected network environment
• ·Restricting user accounts and privileges
• ·Updating packages to receive the latest patches

·Encryption

·At Airtable we use encryption mechanisms to protect our customer's data. Airtable has implemented appropriate safeguards and protocols to protect the creation, storage, retrieval, and destruction of secrets such as encryption keys and service account credentials.

·Data in Transit Data transmitted between customers and Airtable's service is protected using TLSv1.2 or higher.

·Data at Rest

·Data at rest is encrypted using AES 256-bit encryption within Airtable's systems.

·Access control

·Airtable is hosted in AWS and uses role base access to manage the users who have access to Airtable's production environment.

·We ensure that access permissions and authorizations for all systems (including tools, applications, databases, operating systems, hardware, etc.) are managed to incorporate the principles of least privilege and separation of duties. These access privileges are reviewed at least quarterly.

·Secure Authentication

·Multi-factor authentication Unique account and user ID

·Password Management

·Strong password parameters Encryption leveraged for passwords

·User Provisioning

·Role-based access control

·Principle of least privilege and separation of duties

·Data retention and disposal

·Airtable maintains explicit policies for data retention and deletion. Data is generally retained indefinitely until a user issues a request via the application to delete the data or provides a request to Airtable to delete the account or data. Airtable also maintains backups of the data and a revision history subject to the chosen plan. The different plans can be found here and retention schedules can be found here. Upon completion of permanent deletion, the data cannot be recovered.

·Airtable maintains high availability through multiple availability zones, crossregion replication, and backups.

·Efficient Provisioning

·User access is removed immediately following termination Assets are collected upon termination

·Monitoring and Risk Management

·System monitoring, logging, and alerting

·Airtable implements extensive monitoring, observability, and alerting in our production environment. We utilize several tools for logging and monitoring purposes, including a SIEM solution.

·We have a permanent audit log for production access that is required to access confidential data. Administrative and security activities in AWS are logged, with the logs stored permanently and protected against alteration or modification. Access to the log files is limited to the Security Team.

·Alerts are configured as part of monitoring any activity. Critical alerts are actioned upon immediately. Airtable implements extensive monitoring which will automatically alert the Airtable Security team, which is on-call 24x7x365. For any service-impacting event, Airtable will work to restore availability with the highest possible urgency until service is restored. Current and past status of Airtable's availability can be found at status.airtable.com.

·Vendor management

·Prior to engaging any third-party subprocessor or vendor, Airtable evaluates their privacy, security, and confidentiality practices, and executes an agreement implementing its applicable obligations.

·Subprocessors are reviewed on a yearly cadence; all other vendors are reviewed upon renewal of agreement. The review considers risk factors such as the sensitivity of data stored in the service, the criticality of Airtable's dependency on the service, and the reputation and history of the service. Airtable has policies in place that ensure that all subcontractors with any access to customer data are bound by strict NDAs and adhere to data protection requirements from Airtable's customers.

·Please view the details of our third-party sub-processors here.

·Risk assessment

·Airtable conducts formal risk assessments at least annually to identify, assess, and mitigate risks to the confidentiality, integrity, and availability of Customer Data. Risk assessment results are documented and reviewed by management, with findings remediated based on risk level and priority.

·Change Management

·Airtable utilizes an agile methodology for software development, and performs extensive code reviews and testing before each release.

·Airtable implements a formal change management program that integrates security into the software development lifecycle, using OWASP Top 10 standards and regular developer training. All code changes undergo security review, testing (including SAST and DAST), and are logged through a secure build and deployment pipeline with rollback capabilities.

·Five ways to contact us about a security concern:

·Email to support@airtable.com Email to security@airtable.com

·Use our Bug Bounty Program https://hackerone.com/airtable

·Contact your Airtable Customer Support Manager or Account Executive

·Contact Airtable support via the in-app messaging widget that is available within airtable.com, the Android App, iOS app, macOS app, and the Windows App

·Incident Management and Business Continuity

·Responding to security incidents

·Airtable follows a documented Incident Response Plan. The response plan includes steps for initiating the response plan, escalation, engaging external resources, triage and investigation, analysis, mitigation, restoration, and post-mortem. Our Information Security team proactively mitigates vulnerabilities and takes all reports of security-related issues very seriously.

·An Incident/Event Response team is available 24x7x365 with a notification process identified with the preferred method (phone, email, text, etc.) available to customers/clients to report incidents. A customer is also able to communicate a security concern using one of our contact options.

·By policy, Airtable notifies any users affected by a security or privacy incident without undue delay of becoming aware of a data breach. Incidents are classified by severity levels, and there are procedures to collect and maintain a chain of custody for evidence during an incident investigation.

·Disaster recovery and business continuity plan

·Airtable has developed a Business Continuity and Disaster Recovery (BC/ DR) Plan that outlines high-level strategies for restoring critical business functions. These strategies include resuming operations from backup locations, establishing communication among core team members, and executing operations playbooks for restoring from backups.

·We test and review the plans annually. Airtable's BC/DR plan, processes, and procedures are audited as part of our SOC 2 Type 2 and ISO 27001 certifications and are fully compliant with both standards. ISO 27001 Certified ISO 27701 Certified

·External Validation

·Security compliance

·Airtable complies with applicable laws and regulations, including US law and GDPR. Airtable is SOC 2 Type 2, ISO 27001, and ISO 27701 certified. Airtable is also GDPR and CCPA compliant. Further information can be found at: https://www.airtable.com/security.

·Our Head of Compliance manages our compliance monitoring program which, along with policies, is reviewed annually in conjunction with Leadership and applicable business stakeholders. The review is to ensure compliance with applicable legal and regulatory obligations.

·Vulnerability management

·Airtable checks for vulnerabilities across a range of vectors. Prior to software deployment, code is scanned for any errors and vulnerabilities. Airtable also runs frequent scans on the application levels, across endpoints, and across the network.

·Airtable also utilizes a bug bounty program via HackerOne. The bug bounty program includes application and network layers. Security researchers can responsibly disclose vulnerabilities by submitting to our public HackerOne bounty program at https://hackerone.com/airtable or by emailing security@airtable.com.

·Airtable hires a third party to conduct an external penetration test on an annual basis. Vulnerabilities are assessed based on the Common Vulnerability Scoring System (CVSS).

·Airtable's response and remediation to vulnerabilities depends on the severity and risk rating of the findings. Airtable has set industry standard SLAs based on the severity of the vulnerabilities. Upon request and execution of an NDA, we can share a summary of the test results.

·Awareness Training

·Airtable maintains an auditable and comprehensive Security Awareness program to help ensure that employees are aware of and understand the security policies and procedures they are required to abide by.

·The training consists of information security rules and policies, personal accountability and responsibilities, practical steps such as password security, and contact points for escalating security and privacy-related issues. This training reminds all attendees to uphold the code of conduct, ethics, and compliance.

·Security and privacy training is required for all employees and on a perrole basis for contractors. Airtable employees are required to participate in annual security awareness training where these concepts are reinforced.

·Airtable also provides role based security awareness training for developers upon onboarding which includes, but is not limited to, training on the OWASP Top 10 and STRIDE threat modeling methodology.

·Conclusion

·Our goal is to empower individuals and organizations to structure, organize, and maximize value from their data. As such, we treat the protection of your privacy and security with the utmost priority. We are committed to continuously evolving best practices to support this principle.

·Our Security team is here to answer any questions you may have. You can reach us by emailing security@airtable.com or by reaching out to your contact at Airtable. Security at Airtable 12