Security - Chargebee

·Security and Compliance at Chargebee

·Trust and Compliance at Chargebee

·Chargebee prioritizes security and has established robust compliance practices to protect customer data and provide assurance across our services. Security remains integral to our operations, supported by globally recognized security frameworks and certifications.

11. Certifications and Trust Center

·PCI DSS Level 1

·Chargebee is PCI DSS Level 1 certified - the highest standard of PCI compliance, and is listed on the VISA Global Registry of Service Providers. We are subject to an annual external audit by a Qualified Security Assessor (QSA) to achieve this certification. This compliance demonstrates Chargebee's stringent data security measures, ensuring card information is securely processed, stored, and transmitted. Web application security, data encryption and periodic penetration tests underpin our ongoing compliance. [In scope: Chargebee Billing]

·[View Certificate] | [VISA Global Registry of Service Providers] | [PCI Resources]

·ISO 27001:2022

·Chargebee is certified under ISO 27001:2022, an internationally recognized standard that sets requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). Chargebee's ISMS covers key areas such as security policies, risk management, access controls, cryptography, physical security, and supplier relationships. This certification affirms that we have robust controls in place for managing data securely, and we undergo regular assessments to ensure ongoing compliance with this global standard. [View Certificate]

·SOC 1 Type II

·Chargebee's SOC 1 Type II report provides independent assurance of our financial controls and systems. The report evaluates the effectiveness of our internal financial reporting controls. Annual audits by external auditors reinforce transparency with our customers.

·[In scope: Chargebee Billing and RevRec]

·SOC 2 Type II

·Chargebee's SOC 2 Type II compliance confirms our robust data security, availability, and confidentiality practices. Annual assessments by third party auditors validate our operational controls, ensuring accountability and demonstrating Chargebee's commitment to maintaining high standards for data protection.

·To request a copy of Chargebee's compliance reports or certifications, please contact us at compliance@chargebee.com.

·Data Privacy Framework

·Chargebee is certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework relating to the transfer of personal data from the EU, UK, and Switzerland to the USA.

·Frequently asked questions on certifications

• ·What is the standard audit period for SOC reports at Chargebee? Chargebee's SOC 1 and SOC 2 reports typically cover a 12 month audit period, specifically from December 1 of the previous year to November 30 of the current year.
• ·Does Chargebee issue bridge letters upon request? Yes, Chargebee provides a bridge letter which covers the period from December 1 to December 31, supplementing the latest audit report. The SOC report along with the bridge letter is available as a bundle upon request and can also be accessed via an in app feature within the Chargebee application.
• ·What level and version of PCI Compliance does Chargebee hold? Chargebee is a PCI DSS Level 1 Service Provider and is certified against the Payment Card Industry Data Security Standard (PCI DSS) v4.0.1.
• ·Do I need to be PCI compliant if I use Chargebee? PCI DSS applies to any merchant that stores, processes or transmits cardholder data (CHD). Please refer to the Help docs to understand the PCI compliance recommendation based on the integration method you choose with Chargebee.
• ·How does Chargebee support PCI compliance and where can I access the PCI SAQ forms? Chargebee helps simplify your PCI compliance efforts. As a PCI DSS Level 1 certified provider, Chargebee ensures cardholder data never touches your servers when using secure integrations such as Chargebee.js or hosted payment pages. For detailed information, please refer to the PCI Recommendations and Integration Types.
• ·Secure by Design: Sensitive card data is encrypted and sent directly to Chargebee's secure PCI compliant environment.
• ·Simplified Compliance: By leveraging these integrations, you qualify for simplified PCI questionnaires (SAQ A or SAQ A-EP). SAQ templates can be accessed from the 'document library' of the official website of PCI council.
• ·Shared Responsibility: You are responsible for securing your systems up until the data enters Chargebee's environment.
• ·Where can I find the PCI Responsibility Matrix between Chargebee and its merchants? The PCI Responsibility Matrix, which outlines the allocation of PCI DSS requirements between Chargebee and its merchants based on how the platform is used, can be accessed here. It provides a detailed overview of which party (i.e. Chargebee or the merchant) is responsible for each control, helping ensure clarity and compliance with PCI standards.
• ·Can I get a copy of Chargebee's latest Penetration test report? Due to the sensitive nature of penetration test reports, Chargebee does not share the full report externally. However, a summary or attestation is available upon request. Please contact security@chargebee.com for more details.

22. Security Practices

·Application Security

·Secure Coding Practice

·Chargebee follows effective secure coding practices throughout the software development lifecycle to address vulnerabilities, including those highlighted in the OWASP Top 10. Our developers attend regular secure coding training sessions and perform detailed code reviews to maintain high standards of security and quality.

·Vulnerability Management

·Chargebee employs robust vulnerability management processes, including automated scanning, manual testing, and timely remediation. Vulnerabilities identified are prioritized based on risk and swiftly addressed by our security and development teams.

·Regular Security Testing

·We conduct regular penetration tests and security assessments by certified third party experts to proactively identify and mitigate security vulnerabilities, ensuring continuous improvement of our security posture.

·Authentication

·Chargebee has implemented strong authentication mechanisms, including Two Factor Authentication (2FA), Role Based Access Control (RBAC), and Single Sign On (SSO)/SAML based integration with leading identity providers. These measures enhance security and streamline user access management.

·Infrastructure Security

·Cloud Infrastructure

·Chargebee utilizes secure, reliable cloud providers that implement rigorous physical and logical security measures to ensure infrastructure protection.

·Physical Security

·Chargebee relies on reputable cloud infrastructure providers to host its services. These providers maintain stringent physical security measures at their data centers, including biometric authentication, two factor access control, video surveillance, and 24x7 security personnel to ensure robust protection against unauthorized access.

·Network Security

·Chargebee's network security includes advanced firewall protection, Distributed Denial of Service (DDoS) mitigation, and measures to prevent Man In The Middle (MITM) attacks. Regular internal scans and external Vulnerability Assessment and Penetration Testing (VAPT) further reinforce our network defenses.

·Monitoring and Logging

·Chargebee maintains a 24x7 Security Operations Center (SOC) team continuously monitoring infrastructure and application activities. Advanced logging mechanisms facilitate timely detection, investigation, and response to security incidents.

33. Risk Management

·Vendor Risk Assessment

·Chargebee evaluates third party service providers to ensure they meet our security and compliance standards. As part of our third party risk management process, we conduct both initial and ongoing assessments that include vendor screening, review of security certifications, independent audit reports, and evaluation of the security measures implemented by the service providers.

·Internal Risk Assessments

·Chargebee regularly performs internal risk assessments to proactively identify, evaluate, and address potential security risks within our operations. These assessments support ongoing improvement of our security posture.

44. Data Privacy

·Compliance with laws

·As a global organization, Chargebee is committed to protecting personal data through robust technical, organisational and contractual measures in accordance with applicable laws, including:

• ·General Data Protection Regulation (GDPR): Chargebee operates in compliance with the EU and UK GDPR, offering data processing agreements, standard contractual clauses, and assistance for customer obligations such as exercise of data subject rights, conducting data protection impact assessments, etc.
• ·California Consumer Privacy Act (CCPA): Chargebee complies with CCPA, ensuring that the privacy rights and protections of California residents are maintained. We offer transparency regarding data collection and usage, and provide customers control over their personal data in line with CCPA requirements.
• ·Health Insurance Portability and Accountability Act (HIPAA): While customers are generally prohibited from sharing PHI to Chargebee products, Chargebee supports HIPAA compliance for Chargebee Billing product upon specific request from customer in this regard and upon entering into appropriate Business Associate Agreements (BAA).

·Data protection principles

·Chargebee's data handling practices, internal processes and policies are grounded in the core principles of data protection law, including:

• ·Lawfulness and transparency: Personal data is collected only when there is a valid legal basis to do so. Clear notices are provided and consent is obtained where required, ensuring transparency and fairness in how data is collected and processed.
• ·Purpose limitation: Data is collected and processed only for specific and legitimate purposes.
• ·Data minimisation: Only the minimum necessary information required for the intended purpose is collected and processed.

·Training and Awareness

·At Chargebee, all employees undergo mandatory privacy and information security training as part of onboarding, with annual refreshers to ensure continued awareness of evolving regulations and threats. Awareness is also enforced through targeted, role based training.

·Contractual safeguards

·Chargebee ensures that all personnel handling personal data are bound by confidentiality obligations as part of their engagement with Chargebee. Chargebee also ensures that appropriate contracts and clauses are included in the engagement with third parties, including data processing agreements and standard contractual clauses.

55. Resilience and Business Continuity

·Incident Management

·Chargebee has a structured incident management process for timely identification, response, and resolution of security incidents to minimize impact and maintain service reliability.

·Business Continuity Plan

·Chargebee maintains a comprehensive business continuity plan to ensure operational resilience and uninterrupted service delivery during disruptions or unforeseen events.

·Disaster Recovery

·Chargebee's disaster recovery strategy includes regular backups, failover mechanisms, and recovery testing to quickly restore services and minimize downtime.

66. Responsible Disclosure Program

·Chargebee encourages responsible disclosure of security vulnerabilities. Security researchers can confidentially report vulnerabilities to our security team, promoting secure practices and responsible cooperation. For details, please refer to our Responsible Disclosure Policy.

77. Contact Us

·Please reach out to our dedicated teams at security@chargebee.com for security related questions, and compliance@chargebee.com for compliance related inquiries.