When we discuss our priorities in Feelingstream, one thing is always clear. We obviously want to get new customers or develop the next feature. But what is always at the top of our list? Data security. Security for our customers. The data security for the customers of our customers. The security of our services. And so on.
So, therefore we are opening this topic up in this article – we want to share what data security means for us at Feelingstream. As this is our priority.
Data security for setup
We offer on-premises or cloud-based setups. The choice is up to the customer based on their needs.
Firstly, the on-premises deployment model is designed for use-cases where the full service with all its microservices is deployed internally on the customer’s internal data centre. Deployment does not require any internet connection for its operations.
Secondly, the closed cloud deployment model is one of the latest options for balancing the on-premises security and cloud resource availability. In this case, the customer or Feelingstream rents the cloud resources with a suitable cloud provider like Microsoft Azure, AWS or Google Compute Cloud. The customer can audit and verify the deployment. This setup provides scalable resources with verified security levels.
The third option that we offer is the Feelingstream own cloud-based model. We have our cloud environment with a third-party provider named above within the European Union. None of the data leaves the EU, the setup is completely secure and separated between our customers.
Anonymisation or sanitisation of data
As we gather data from calls, emails, chat and feedback, there is a wide variety of personally identifiable information (PII) in the conversations.
We can anonymise (sanitise) conversations from different channels. Feelingstream follows specific guidelines for media sanitisation. We anonymise data across channels, including numbers, names, etc. This is to ensure the confidentiality of textual information as needed. We change the voice of the speaker in audio format to make the person unrecognisable.
Data for Feelingstream employees and for model building
Feelingstream has created our own automatic speech recognition (ASR) models for use for transcription and the Feelingstream platform. When it comes to further training of the ASR models or model building (for example, for topic classification), we need data from the specific customer.
When the data scientists start work on the models, the customer provides data and this will only be accessible to the specific persons that need access to it during model building. Feelingstream employees have only need-based and minimal access to customer data. If possible and needed, we can also use anonymous training data (meaning we use partial conversations for model creation). Once the modelling is complete, we delete the data.
Access policy
In our product, we have implemented a granular user-groups based access policy. Different groups have access to conversations based on their needs.
For example, some users might need only to see phone calls that they have answered, some users need to listen to calls answered by a specific team. As we also anonymise conversations, then administrators can give certain user groups or users access to only anonymised data, whereas others may have full data.
Activity trail and logging
All activities in our product are logged. That includes any activities for any users. If needed, we can later reconstruct the user journey. We can see what the user has looked at and what they’ve done.
Data security during transmission and technical setup
To protect data during transmission, all data transmissions are encrypted using industry-standard SSL (Secure Sockets Layer). We use the TLS1.2 specification for SSL encryption.
The platform provides out-of-the-box integrations for HTTP/HTTPS REST API to insert and export data. There’s also an SFTP service so that audio files and metadata can be delivered over SFTP protocol.
For emails, we use SMTPS together with DMARC to verify and validate the senders’ domain.
Our mission-critical systems have technical security layers including firewalls, authentication points and segregated networks:
- We have firewalls that help intercept suspicious network traffic in the system so that external attackers cannot access or extract information.
- Access to the remote network in cloud infrastructure is over VPN or HTTPS with limited access from defined IP (Internet Protocol) addresses. Users only have access to required services and they need to authenticate with personal credentials.
- Segregation and segmenting our network and services makes it possible to separate and manage components. In each network, users only see and can access what they need based on setup and user rights.
Deleting data
We keep data for analysis only for the amount of time that our customer has specified in their needs. We can have separate times that we keep anonymised or non-anonymised data, audio or text. When the customer has decided the period for the data they want to be accessible, we can delete older data as we go along. Once we have deleted the data, it is not restorable.
Our goal is to strengthen our data security and overall security even more
On 16th May 2023 Feelingstream obtained the ISO/IEC 27001 certification. The scope of the certification is ISMS (Information security management system) covering development, deployment, support, and maintenance of conversation analytics platform and customer service.
This achievement demonstrates our dedication to ensuring strong data security practices. This was no easy task; it required a rigorous process that went beyond a simple request for accreditation. Nonetheless, our unwavering commitment to data security drove us to achieve this milestone.
Read more from our blog to get a general understanding of conversation analytics and what we do at Feelingstream.
