Fivetran Security Policy

·Security

·Fivetran is committed to providing a robust security program that protects each customer's information that is used and processed by Fivetran for providing our products and services. The following security documentation describes the administrative, physical, and technical safeguards Fivetran maintains for protecting the security, confidentiality, and integration of Customer Data while connecting, replicating, and loading data from all your data sources. To learn about Fivetran security in detail, see our security white paper. Any terms that are used but not defined herein shall have the meanings assigned to them in the Fivetran Master Subscription Agreement.

·Deployment options

·Fivetran offers the following deployment options so you can choose where your data moves between the source and destination:

• ·SaaS: The SaaS model is fully managed in Fivetran's cloud. Depending on your pricing plan, you can choose the region and data center where you want to host Fivetran in the cloud.
• ·Hybrid: The Hybrid Deployment model allows you to process your data within your own network while leveraging Fivetran's cloud to orchestrate the data movement. It provides a balance for organizations that need to keep their data local for security reasons but still want to benefit from Fivetran's managed service.

·Learn more about our deployment models in our Deployment Models documentation.

·Company policies

• ·Fivetran requires that all employees comply with security policies designed to keep any and all customer information safe, and address multiple security compliance standards, rules, and regulations.
• ·Two-factor authentication and strong password controls are required for administrative access to systems.
• ·Security policies and procedures are documented and reviewed on a regular basis.
• ·Current and future development follows industry-standard secure coding guidelines, such as those recommended by OWASP.
• ·Networks are strictly segregated according to security level. Modern, restrictive firewalls protect all connections between networks.

·Responsible disclosure policy

·At Fivetran, we are committed to keeping our systems, data, and product(s) secure. Despite the measures we take, security vulnerabilities will always be possible.

·If you believe you've found a security vulnerability, please email us at security@fivetran.com. Include the following details with your report:

• ·Description of the location and potential impact of the vulnerability
• ·A detailed description of the steps required to reproduce the vulnerability (POC scripts, screenshots, and compressed screen captures are all helpful to us)

·Make a good faith effort to avoid privacy violations as well as destruction, interruption, or segregation of services and/or data.

·Your organization permissions

• ·Users can use Single Sign-On with SAML 2.0. See the list of identity providers officially supported by Fivetran.
• ·Only users of your organization registered within Fivetran and Fivetran operations staff have access to your organization's Fivetran dashboard.
• ·Your organization's Fivetran Dashboard provides visibility into the status of each integration, the aforementioned metadata for each integration, and the ability to pause or delete the integration connection - not organization data.
• ·Organization administrators can request that Fivetran revoke an organization member's access at any point; these requests will be honored within 24 hours or less.

·Connections

• ·Connections to customers' database sources and destinations are SSL encrypted by default.
• ·Fivetran can support multiple connectivity channels.
• ·Connections to customers' software-as-a-service (SaaS) tool sources are encrypted through HTTPS.

·Permissions

• ·Databases and API cloud applications - Fivetran only requires READ permissions. For data sources that by default grant permissions beyond read-only, Fivetran will never make use of those permissions.
• ·Destinations - Fivetran requires the CREATE permission. This permission allows Fivetran to CREATE a schema within your destination, CREATE tables within that schema, and WRITE to those tables. Fivetran is then able to READ only the data it has written.

·Web portal connectivity

• ·All connections to Fivetran's web portal are encrypted by default using industry-standard cryptographic protocols (TLS 1.2+).
• ·Any attempt to connect over an unencrypted channel (HTTP) is redirected to an encrypted channel (HTTPS).
• ·To leverage HTTPS, your browser must support encryption protection (all versions of Google Chrome, Firefox, and Safari).

·Solution infrastructure

·Access to Fivetran production infrastructure is only allowed using hardened bastion hosts, which require an active account protected by MFA (multi-factor authentication) to authenticate. Further access to the environment and enforcement of least privilege is controlled by IAM (identity and access management) policies. Privileged actions taken from bastion host are captured in audit logs for review and anomalous behavior detection.

·Physical and environmental safeguards

·Physical and environmental security is handled entirely by our cloud service providers. Each of our cloud service providers provides an extensive list of compliance and regulatory assurances, including SOC 1/2-3, PCI-DSS, and ISO27001.

·Google

·See the Google Cloud Platform compliance, security, and data center security documentation for more detailed information.

·Amazon

·See the Amazon Web Services compliance, security, and data center security documentation for more detailed information.

·Azure

·See the Azure compliance, security, and data center security documentation for more detailed information.

·Data access

·We use data minimization to limit: how often we access customer data for troubleshooting, direct access to customer data, and what we use when we interact with customer data, such as the use of obfuscated data rather than raw customer data values. We have tightly controlled troubleshooting environments with strict technical security safeguards, including: role-based access controls (SSO, reviews, etc.), logical separation, obfuscation, pseudonymization, short retention (obfuscated data is retained for 1 week), and secure storage.

·Fivetran Activations

·By using Fivetran Activations, you provide approval for the following limited access: We may view your data within the product user interface solely in the course of troubleshooting to resolve Fivetran Activations errors that you raise to us. This includes observability features in the user interface that show samples of customer data. For example, records that are sent in syncs, and previews of query results from datasets set up by a customer. The visibility of data in Fivetran Activations and what we can access is determined by what permissions you grant in the set up of connected integrations (such as sources and destinations). You can employ additional controls, like designating a column as PII, which will prevent a column with a PII designation from being displayed within the user interface. In most cases, Fivetran Activations data is only stored for the duration of an activation sync, see the Activations Security & Privacy documentation for more details and exceptions to this policy.

·Certificate Verification

·Transport Layer Security (TLS, also referred to as Secure Socket Layer, HTTPS, or SSL) is one of the encryption methods that Fivetran uses to secure data in motion. TLS allows for both encryption and authentication of the connections that Fivetran makes to your data sources and to your destinations.

·Fivetran connections made over TLS are always encrypted, and support automatic verification for connections that use hostname verification (such as web-based applications), and for proprietary systems with built-in certificate authority management such as Snowflake, BigQuery, and Redshift.

·For other connections, such as customer operated databases, we support verifying a certificate using root certificate authority verification.

·Verifying a certificate

·Connections require a user to explicitly select the certificate to use as the trust anchor. Customers who use self-signed certificates for their databases can do the verification based on the fingerprint of the certificate, and customers who use a certificate authority model can select the authority which Fivetran should validate against.

·Auditing trusted certificates

·The account page in your Fivetran dashboard includes a section where your security team can audit all the trust selections that have been made within your Fivetran configuration. You have the option to revoke the trust of a certificate at any time. Once a certificate's trust has been revoked, you will need to re-run the setup tests for any affected connections to select the new certificate and resume data replication.