AlphaSights Security Overview

AlphaSights ensures its personnel are contractually committed to confidentiality. AlphaSights has ongoing security and privacy education, training and awareness for any employees working with Client Confidential Information. AlphaSights has robust internal policies, guidelines and documentation that address AlphaSights' IT and Platform security processes to mitigate cybersecurity risks related to access controls, data loss prevention and the protection of Client Confidential Information. These policies are made available to all personnel.

AlphaSights maintains adequate physical security controls at all locations at which Client Confidential Information is processed. This includes, but is not limited to, entry access controls, personnel badge requirements and securing IT equipment.

AlphaSights may use third party vendors to support the provision of its services. AlphaSights performs appropriate security risk assessments and due diligence on vendors with access to Client Confidential Information to ensure they have appropriate security controls proportional to the service they are providing and the associated security-related risks.

AlphaSights has a documented incident response plan that addresses the relevant steps in the investigation of an incident that may occur within AlphaSights' Client-Facing Domain or internal systems, including preparation, detection, containment and post-incident activity.

AlphaSights has access rights management procedures to prevent unauthorised access to Client Confidential Information. This includes implementation of SSO and 2FA authenticated accounts for AlphaSights employees, with access permissions managed in accordance with the principles of least privilege and separation of duties. AlphaSights also has robust accessibility restrictions for Client Users of the Client-Facing Domain, including unique Client User IDs and re-authentication of accounts via email following inactivity.

AlphaSights has established business continuity and disaster recovery plans that mitigate risks of disruptive incidents to Client Confidential Information. AlphaSights ensures high availability and redundancy for all critical applications and databases and design infrastructure to enable the automated reconstitution of environments.

AlphaSights has robust change management processes, including separate development, testing and operational environments, adhering to the principles of least privilege and documenting changes, to reduce the risks of unauthorised access or changes to the operational environment.

AlphaSights has continuous and proactive processes to identify, prioritise, prevent, recover and remediate and report on vulnerabilities that threaten the security and confidentiality of Client Confidential Information, including the implementation of firewalls, anti-virus and anti-malware software and patch management procedures.

AlphaSights protects Client Confidential Information by: (i) using up-to-date encryption in transit and at rest, with the protection of ingress and egress through web application and network firewalls respectively; and (ii) deploying disk-based encryption for all AlphaSights laptops accessing Client Confidential Information, with power-on authentication.

AlphaSights applies data destruction procedures and processes to delete any transcripts and recordings made available on the Client-Facing Domain securely and irretrievably in accordance with AlphaSights' internal document retention policies.

AlphaSights regularly backs up and securely stores Client Confidential Information to ensure it can be quickly restored in the event of an incident.

AlphaSights performs scheduled network and application security assessments and penetration testing. We resolve vulnerabilities affecting systems in a timely fashion and address and patch critical and high rated vulnerabilities as soon as reasonably practicable after discovery.