Technical,Organizational and Security Practices

Effective: JULY 2024

Issued by: Vonage Information Security

Document Status: V3.0

Confidentiality Classification: Public

The information contained in this document is subject to periodic revision and customers are advised to check that no later version is available.

TABLE OF CONTENTS

INTRODUCTION

SERVICES COVERED

TECHNOLOGY CENTERED AROUND SECURITY

SUB-PROCESSORS

Third-Party Sub-Processors

Vonage Group Companies

CORPORATE OVERSIGHT

Code of Conduct

Human Resources    

New Hires    

Transfers and Terminations    

Information Security Team    

Information Security Policies    

Security Awareness Training    

Third-Party Hardware and Software Acquisition    

Business Continuity and Disaster Recovery    

Corporate Risk Management  

SECURITY AND OPERATIONS    

Data Security Mechanisms    

Session Border Controller    

Security Advantages    

Firewalls    

Anti-Malware and Antivirus    

IDS/IPS and FIM    

Security Monitoring    

Vulnerability Management    

Patch Management    

Hardening and Configuration of Servers    

Patching    

Penetration Testing and Remediation    

Bug Bounty and Responsible Disclosure Programs    

Account and Access Management    

Account Management    

Administrative Access    

Password Management    

Data Loss Prevention    

Information Security Incident Response and Reporting    

Customer Impact and Notification    

Interested Third Party

DATA PRIVACY CONTROLS

Data Classification, Retention, and Destruction    

Cryptographic Key Management    

Use of Encryption    

Voice Traffic Confidentiality    

Personnel Access to Secure Premises   

CHANGE MANAGEMENT

COMPLIANCE CERTIFICATIONS    

VONAGE BUSINESS COMMUNICATIONS    

● Enterprise West Platform    

● Vonage Business Cloud Platform    

VONAGE CONTACT CENTER (formerly NewVoiceMedia)    

VONAGE VIDEO API    

VONAGE API (Voice/SMS)    

VONAGE AI (formerly Over.ai)    

VONAGE AI Studio    

INTRODUCTION

Vonage is a software technology company that enables high-quality voice and messaging services across multiple devices and locations, over broadband and Public Switched Telephone Network (PSTN). Vonage is a leading provider of cloud communication services for businesses, providing a robust suite of feature-rich business communication solutions that offer flexibility, portability, and ease of use across multiple devices designed to meet the needs of a wide range of customers. 

Vonage is committed to maintaining the highest standards of security concerning the services we provide to our customers and acknowledges our responsibility to maintain the confidentiality, integrity, and availability of our customer’s data. This document intends to provide information regarding the Standards for Security (administrative, technical, and physical controls), Privacy, and General Infrastructure that we have implemented and maintained across all our platforms and regions. 

We will highlight our efforts to meet or exceed industry best practices by providing the appropriate administrative, technical, and security measures to ensure that data provided through the use of our services is appropriately handled and processed, in addition to being securely stored and protected. We hope this information will help you in your decision to make Vonage your business communications provider of choice.

SERVICES COVERED

This document covers the following Vonage services:

• Communications APIs and all related services listed here 
• Network APIs and all related services listed here 
• Unified Communications and all related services listed here 
• Contact Centers and all related services listed here 
• Conversational Commerce and all related services listed here 

The covered services are operated in a multi-tenant architecture that is designed to segregate and restrict customer data access based on business needs. The architecture provides an effective logical data separation for different customers via customer-specific accounts in one or more geographic regions and allows the use of customer and user role-based access privileges.

High quality of the service is achieved through:

• Continuous system monitoring (including end-to-end monitoring);
• Infrastructure monitoring;
• Performance testing;
• Security testing (penetration testing and regular vulnerability scanning);
• Building the infrastructure to automatically failover for critical applications; and
• Building the platform to scale horizontally in the event of increased requests or peak traffic.

TECHNOLOGY CENTERED AROUND SECURITY

A Secure Software and Application Development Policy has been implemented to ensure that the software is developed in a manner that minimizes both the risk of vulnerabilities and opportunities for attackers to use the development process itself to access sensitive data. The following is a part of the secure development program:

• Developers are trained in secure coding techniques.
• Software application development is based on industry standards and best practices and incorporates information security throughout the software development life cycle (SDLC).
• When new high-risk vulnerabilities that could affect the application are discovered, the current set of best practices is reviewed and improved, to address this.
• Logs created by applications meet the requirements of the Logging Policy.
• Application accounts are managed in a manner consistent with the requirements of Vonage’s Password, and Access and Account Management Policies.
• The Change Management Policy and Process are followed for system and software configuration changes.
• Open Web Application Security Project (“OWASP”) Top 10 is used as guidance for secure development practices.
• Penetration testing tools and services are employed to discover security vulnerabilities in the target application. 
• Network scanning tools are used to determine that only required network ports are open.
• Vulnerability scanning is used to determine vulnerability status and provide remediation where necessary.
• A responsible disclosure (bug bounty) program is in place to find and address vulnerabilities.

Vonage operates a Secure Software Development Life Cycle (SSDLC) process that is monitored and regularly reviewed to be in line with industry best practices. Vonage has regular training sessions, educating developers on OWASP Top 10 and other security best practices. Code reviews and approvals are supported by various internal policies. The following standards are taken into account:

• CERT C++ Secure Coding Standard

• OWASP Top 10

• OWASP API Security Top 10

• OWASP Guide to Build Secure Web Applications and Web Services

• Microsoft .Net Framework Security Guidelines

SUB-PROCESSORS

Third-Party Sub-Processors

Vonage engages certain third-party companies (“Sub-Processors”) in the provision of the services.  

Vonage has entered into written agreements in the form of a Data Processing Addendum (“DPA”) with each of its Sub-Processors, which contain data protection and data security obligations, as well as the technical and organizational security measures, appropriate to their processing activities. When legally required, these DPAs incorporate the Standard Contractual Clauses in the form set out in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 and/or the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, which apply when the sub-processor transfers personal data from the European Economic Area (EEA) or the UK to countries outside the EEA or the UK that do not have an adequacy decision from the European Commission or the UK government.

Vonage Group Companies

In addition, each of our sales contracting entities may utilize other Vonage group companies in the provision of the services, which may include support and billing, and that requires such Vonage Group Companies to process our customers’ data. Vonage has executed an Intra Group Personal Data Transfer Agreement (“IGA”), between and among each of the Vonage group companies, which incorporates the Standard Contractual Clauses set out in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 and/or the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses. These apply when the sales contracting entity transfers personal data from the EEA or the UK to Vonage group companies located in countries outside the EEA or the UK that do not have an adequacy decision from the European Commission or the UK government.

CORPORATE OVERSIGHT

Code of Conduct

Corporate policy mandates that every employee (full- or part-time) is obligated to follow Vonage’s Code of Conduct. Employees must acknowledge receipt and understanding of the Code of Conduct documentation. Failure to follow the Code of Conduct or breach of any confidentiality agreement results in disciplinary action and/or immediate termination of the individual’s employment at Vonage’s sole discretion.

Human Resources

The Human Resources department screens all new employees following the best legal guidance, and they are subject to the terms and conditions of employment that define their information security responsibilities. Employees enter a period of probation and are monitored throughout this period. All employees are required to adhere to the information security policies and procedures, and are provided with ongoing awareness, education, and training. The Company’s Acceptable Use Policy is enforced for all users, whether through direct access or approved Virtual Private Network (VPN) connections. There is a disciplinary process for failure to comply, up to and including termination of employment.

New Hires

Upon hire, each new full-time and part-time employee must sign some or all of the following:

• If outside the United States, an employment contract containing confidentiality clauses;
• the Vonage Employee Covenants Agreement; and
• other regionally required or permitted agreements and policies.

Additionally, depending on the position being filled, some or all of the following checks are performed, as permitted by regional and local employment laws and regulations:

• two professional references;
• an identity background check;
• a criminal background check; and
• a financial background check, based on the job role and responsibilities.

Any temporary resources such as contractors or consultants must sign an appropriate contract governing the provision of their services, which includes robust privacy, confidentiality, and security provisions.

Transfers and Terminations

Internal transfer to another department, which includes job responsibilities changes, may require a change in access to certain systems, applications, nodes, data centers, and building access. When this occurs, the appropriate Access Request tickets must be submitted to have the user’s access modified or terminated. Quarterly access reviews are also employed to ensure that permissions are contemporary.

Vonage’s termination process ensures that access to any and all systems, applications, nodes, and data centers, as well as access to buildings, is terminated on the employee’s or contractor’s last day with the organization. The last day may be prior to the contractual last day of employment. Transfer and termination activity is tracked in our ticketing system. Access to systems, applications, nodes, data centers, and buildings may be suspended while an employee is out on an approved leave of absence.

Information Security Team

Vonage’s Chief Technology Officer, along with the Chief Information Security Officer, leads all information security activities across the Vonage organization. Vonage’s Information Security team stays abreast of current threats via both private and public security channels. They leverage commercial security feeds, subscription-based feeds, and open-source information to protect the Vonage network. The Vonage Information Security team’s credentials include CEH, CRISC, CISM, CISA, CISSP, GIAC, OSCP, Security+, ISO27001 CIS LI, ISO27001 CIS LA, and PCI-ISA. The team’s responsibilities include, but are not limited to:

• Daily log reviews
• Monitoring and managing security alerts
• Vulnerability scanning
• Penetration testing
• Incident response management
• Management of internal and external security certification audits
• Security awareness and compliance training
• Information Security policy and program management

In collaboration with our Legal department, Vonage’s Data Protection Officer oversees Vonage’s data protection strategy and implementation to determine and ensure compliance with all applicable data protection laws around the globe.

Information Security Policies

Vonage takes seriously its responsibility to manage the confidentiality, integrity, and availability of customer data. An Information Security program is in place, and a number of security policies and procedures support the program. Policies and procedures are reviewed and/or updated at least annually, and the policies are approved by Legal and the Head of the Information Security Program prior to publication. Security policies and practices undergo a standardized process of development, review, and approval, including industry benchmarking. These policies have been implemented to include up-to-date technical controls, physically strong and secure facilities, and administrative awareness with regular reviews and sensitivities. All employees and contractors are subject to abide by the set of defined policies and procedures. There is an escalating disciplinary process for violation of policies, up to and including termination. Violations of policies that are also violations of law may result in referral by Vonage to the appropriate law enforcement agency.

Security Awareness Training

The Compliance and Security Awareness Program requires that all new hires and/or tenured employees participate in refresher sessions on a regular basis through the Company’s learning management system (“LMS”). The Information Security team is responsible for maintaining a record of the training modules available in the LMS, and providing evidence of ongoing compliance with the security awareness training requirement. Training includes, but is not limited to:

• Security best practices;
• Information classification and handling;
• Information security incident reporting;
• The individual’s specific compliance and security responsibilities; and
• Identification of further training requirements in support of security and data protection.

Ongoing awareness activities may include:

• Updates to policies and procedures;
• Changes to legal and regulatory responsibilities; 
• Short, bursty training modules and vignettes; and
• Latest threats and vulnerabilities.

Third-Party Hardware and Software Acquisition

Software acquisition is preceded by a structured approval process. Software as a Service (SaaS) and other off-premises hosted service acquisitions follow the corporate procurement process. Vonage complies with computer software copyrights, respects intellectual property rights, and adheres to the terms of software licenses. All computer assets are regularly audited to determine compliance with, and to prevent violation of, contractual license agreements. By default, users do not have administrative rights on their laptops. Requests for elevated permissions are made through the Vonage Information Technology group and audit trails are available for historical purposes.

Business Continuity and Disaster Recovery

If a Vonage office is not available due to a disaster, Working From Home (WFH) employees and other unaffected Vonage offices around the globe will use commercially reasonable efforts to provide business continuity to our customers. Critical business and operational functions, and customer-facing teams, are spread across multiple Vonage offices. 

A cybersecurity exercise, facilitated by either a reputable third-party consulting firm or a qualified information security professional, is held at least annually and involves senior business leaders to test and improve our business and technical response.

Corporate Risk Management

At the highest levels of the Vonage organization, it is understood that risk management plays a critical role in the success of the Company. The Risk Management policy drives the framework and process to be followed to manage risks both internal and external to the organization. 

Risks may be identified by any member of staff. A risk register is implemented and maintained on a regular basis by a Risk Committee. Risks are evaluated in accordance with the following table:                            

Risk Level = Impact × Likelihood

Risks are reviewed, and treated according to the following table:

Risk evaluation and treatment

SECURITY AND OPERATIONS

Data Security Mechanisms

Vonage provides cloud communications solutions and associated services to business customers. Vonage’s voice and data traffic operate over separate virtual Local Area Networks (LANs). This segregation provides security, in addition to allowing the proper voice parameters such as Quality of Service to be implemented, thus optimizing a high-definition voice traffic flow.

Vonage has the following security safeguards in place in order to provide safe transfer of information and voice communications:

• System-enforced password policy
• Fraud monitoring and detection
• Restricted classes of service
• Secure core network with edge-based security
• Encrypting voice traffic between handsets

Session Border Controller

Vonage makes extensive use of Session Border Controllers (“SBCs”) to restrict traffic to authorized users only. SBCs are also an integral part of the Company’s security strategy, identifying and stopping incoming threats to service and security.

• SBCs reside on the border of the internal network and external carriers’ network.  Data is stored temporarily in the SBC’s volatile memory. Once calls are set up, a handshake is made, and packets are sent across the network; once the call is over, data is cleared.
• Management-related communication traffic is secured through Hypertext Transfer Protocol Secure (HTTPS) and Secure Shell (SSH) connections.
• The SBC is managed using Access Control Lists and is configured to pass traffic to carrier endpoints from a list of provided IPs that are allowed through the SBC.

Security Advantages

• SBC acts as a Back‐to‐Back User Agent, which allows the SBC to hide the topology of the internal IP network.
• An SBC can be thought of as a Session Initiation Protocol (SIP) firewall.
• SBC prevents potential attacks such as Distributed Denial of Service (“DDoS”) and spoofing before they impair Voice over Internet Protocol (VoIP) network performance.

Firewalls

Firewall systems are in place to identify and block unauthorized access attempts to corporate systems and customer data. The firewalls also filter outbound traffic based on predefined security rules.

• A Demilitarized Zone ((DMZ) - is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network, usually a larger network (such as the Internet) is implemented to filter and screen traffic, and prohibits direct routes for inbound and outbound internet traffic.
• Host-based firewalls are installed on mobile and employee-owned computers with direct connectivity to the internet.
• By default, inbound and outbound traffic (defined by port, protocol, service, and content), specifically not allowed, is denied, and only legitimate traffic is permitted to pass through firewalls.
• Firewalls are configured to implement stateful inspection.

Anti-Malware and Antivirus

Vonage maintains centrally-managed, anti-malware, and anti-virus protection on desktops, laptops and at the physical location of the Company’s servers, as well as at the virtual server level. Regularly scheduled and emergency updates are implemented throughout the company, and subscriptions are maintained to manage sufficient licensing capacity and up-to-date protections.

Servers in the data centers have the following software items installed and/or configured, regardless of role:

• Security and compliance automation enterprise-level solutions,
• Enterprise-level antivirus solutions, and
• Enterprise-level vulnerability monitoring.

Systems commonly affected by viruses are configured with enterprise-level anti-malware solutions.

Vonage has installed and appropriately configured anti-malware software to protect systems against malicious software. Anti-malware software is capable of detecting, removing, and protecting against viruses, trojans, spyware, and adware. The anti-malware software is configured to quarantine suspected malicious files/viruses and alert appropriate personnel. Malicious files from daily reports and alerts conducted are evaluated and manually removed (or authorized for valid files).

IDS/IPS and FIM

Vonage has deployed host-based agents to provide Intrusion Detection and Prevention (IDS/IPS) services, and File Integrity Monitoring (FIM) level protection. System activity logs are reviewed regularly and necessary action is taken when incidents are noted. Updates are automatic and users are not permitted, by configuration, to modify the settings. Vonage maintains service level agreements (SLAs) with its vendors to manage continued software updates, maintenance support, and the ability to request custom changes to combat threats.

Security Monitoring

Vonage’s Information Security team employs security monitoring software and processes to keep abreast of security issues that might arise. Regular vulnerability scans and periodic penetration tests help to round out the security monitoring program that is in place. Monthly security and compliance meetings are held to determine that procedures are being followed and to address any issues or concerns the teams may have.

Vulnerability Management

Sophisticated attacks on systems to gather financial, confidential, proprietary, and competitively-sensitive information are on the rise. Vonage has taken commercially reasonable efforts to minimize the risk.

• Vonage uses a vulnerability management process that actively scans for vulnerabilities using a combination of commercially-available and purpose-built in-house tools.
• Internal vulnerability scans are at least monthly.
• External vulnerability scans are performed at least monthly.
• Vulnerabilities are treated according to the risk management process defined in the Risk Management section of this document.
• Vulnerability severity is determined using the Common Vulnerability Scoring System ((CVSS) - standard for assessing the severity of computer system security vulnerabilities) where applicable, or vendor-supplied ratings.

Patch Management

Hardening and Configuration of Servers

All servers are built to Vonage's configuration specifications, including best practices for security hardening. Vonage has a patching process with a daily log review, including checks on new patches and a vulnerability assessment process to determine the urgency of patches. Patches are tested before deploying into the production environment. Vonage uses technology to roll out patches and enterprise-level vulnerability management solutions to ensure that systems are correctly patched. Administrative control is limited to Vonage network engineers, each of whom has an individual login, enforced password complexity, full auditing, etc. Vonage has a process in place to regularly review access rights, especially administrative rights.

Patching

Vonage applies patches according to our patch management policy. All deployment of patches or updates require Change Management review and approval, regardless of customer impact. If there is an impact to the customer, when feasible, a communication will be sent before any service interruption occurs. Our patch management program aims to ensure that:

• System components and software have the latest vendor-supplied security patches installed; and
• The timescale for deploying patches relates to the risk level of the vulnerability; higher risk vulnerabilities are prioritized.

Penetration Testing and Remediation

Penetration testing, also known as “red teaming”, has been shown as one of the most effective ways for companies to identify security vulnerabilities. Vonage has embraced this as an important component of its strategy for assessing and remediating risk to infrastructure and data. Vonage maintains a rigorous and documented program of penetration testing as an additional means of reducing risk from outside malicious attacks. This includes scheduled and unscheduled testing by both internal and externally contracted third-party resources. Results of the penetration testing are documented and reported to management. Remediation is addressed quickly and iterative retesting is performed to provide compliance with corporate policy.

Bug Bounty and Responsible Disclosure Programs

Vonage works with an industry leader to implement our private Bug Bounty and public Responsible Disclosure Program. Our third-party provider fully manages our Bug Bounty program, combining analytics and automated security workflows with the expertise of over 300 researchers to find and fix critical vulnerabilities. This continual hands-on testing of our applications, in conjunction with our public Responsible Disclosure Program, complement our efforts in vulnerability management, penetration testing, and secure SDLC in developing a secure platform.       

Account and Access Management

Vonage’s Acceptable Use Policy is enforced for users, whether through direct access or approved VPN connections. Two-factor authentication is used throughout the infrastructure to protect against password compromise and as a matter of best practice.

User access is based on a documented approval process with unique ID assignment and complex passwords, with requirements to change within approved time limits. 

Account Management

• Accounts are only granted to users according to their role requirements.
• No shared accounts or passwords can exist.
• Identity verification is performed prior to resetting a password.
• Accounts will time out or sessions will terminate after, at most, 15 minutes of inactivity.
• A user's account will be locked out following a number of failed login attempts.
• Locked accounts remain locked for at least 30 minutes, or until unlocked by an Administrator.
• Inactive accounts will be deactivated or removed after a period of inactivity.
• Employees' accounts are deactivated immediately after termination and suspended during a leave of absence.
• Accounts used by third parties are activated for the period during which they are needed; they will not remain indefinitely activated.Where 90-day password/certificate renewal cannot be enforced by the equipment or software itself, a security exception must be filed and approved.
• Where 90-day password/certificate renewal cannot be enforced by the equipment or software itself, a security exception must be filed and approved.

Administrative Access

Access is based on a least privileges necessary model and is restricted to the least privileges necessary to perform a Vonage employee’s job responsibilities. Access requests to data centers, nodes, production systems, and applications are documented and authorized by the appropriate management. Generic IDs and accounts are not allowed. Users are authenticated via a unique ID and password that is in compliance with the password policy. Multi-factor authentication is employed for remote access to the network by employees. Access control logs are retained for at least 12 months.

Password Management

Vonage’s password policy and requirements either meet, or exceed, industry standards:

• Default passwords are changed before a new system is brought into production.
• Initial passwords for each new account are unique to that account.
• Passwords for new users must be changed at first login.
• Users must change their passwords at prescribed intervals, or immediately if there is any suspicion the password could be compromised.
• New passwords cannot be the same as a set number of previously used passwords.
• The password length meets or exceeds industry standards.
• Passwords must contain uppercase, lowercase, numeric, and special characters.
• Amazon Web Services (AWS) accounts must have a multi-factor authentication device set. 
• The password must not contain the user's account name or parts of the user's full name that exceed two consecutive characters.
• Complexity requirements are enforced when passwords are changed or created.

Data Loss Prevention

Vonage takes a multifaceted approach to Data Loss Prevention (DLP), which includes: 

• Policies outlining appropriate access and use of internal systems and SaaS platforms.
• Documented Onboarding/Offboarding procedures to ensure adherence to a least privileged access model, as well as timely removal of access privileges for offboarding employees and contractors.
• Quarterly User Access Reviews (UAR) are performed to ensure a least privileged access model. Documented access requests must be submitted and approved by the requestor’s manager.
• An ongoing data categorization effort identifies where sensitive data resides, who has access to the data, and how the data is used.
• Our Security Information and Event Management (SIEM) system ingests logs from our single sign-on (SSO) platform, as well as key SaaS platforms to generate alerts for potential system attacks and anomalous user behavior. 
• A Cloud Access Security Broker (CASB) tool that continuously monitors and actively enforces data handling processes, anomaly detection surrounding account access, and appropriate use of sanctioned SaaS platforms. Additionally, the platform is leveraged to identify PCI-, PII-, and HIPAA-related data inappropriately stored within documents, and to ensure that all documents are appropriately shared using a least privileged model.

These policies, processes, and tools undergo regular reviews to address new technologies, business requirements, and cyber threats.

Information Security Incident Response and Reporting

Vonage takes a structured approach to manage negative outcomes, responding to them if they occur, and identifying potential opportunities that may be discovered during the post-incident review process. Cyber threat mitigation at Vonage is an ongoing process, consisting of multiple steps occurring at different intervals and may be event-driven. Security-related incidents are subject to a formal and mature problem management and root cause analysis. This extends to identified security-related events. As a part of Vonage’s Security and Compliance Program, incident management procedures have been established to:

• Ensure timely identification and resolution of potential information security incidents, events, and weaknesses;
• Identify and implement corrective actions;
• Identify non-conformities and their causes;
• Reduce the causes of non-conformities in the Information Security Management System to prevent recurrence; and
• Review corrective and preventive actions taken and inform customers that may be at risk.

Incidents include, but are not limited to:

• Violation of an explicit or implied Vonage security policy;
• Attempts (either failed or successful) to gain unauthorized access to a system or its data;
• Unwanted disruption or denial of services;
• Unauthorized use of a system for the processing or storage of data; 
• Changes to system hardware, firmware, or software characteristics without the owner's knowledge, instruction, or consent; and
• Unauthorized wireless devices connected to the Card Data Environment ((CDE) - system or networked group of IT systems that processes, stores, and/or transmits cardholder data or sensitive payment authentication data) environment or other sensitive location.

Vonage follows established cyber security incident response best practices, including the following key components:

• Detection and Analysis – Detection can come from multiple sources. Vonage employs SIEM and a large number of sensors in our network that are remotely maintained and monitored by a third party. Upon detection of events, Vonage is notified and responds accordingly.
• Containment – Vonage has the ability through tools, as well as its own backbone, to put various measures in place to contain cyber activity.
• Eradication and Recovery – A potential breach would result in a P1 “All Hands on Deck” response from appropriate personnel within the organization, up to and including Vonage’s Executive team.
• Post-Incident Activity – There are numerous components to post-incident activity. This category includes everything from system hardening and lessons learned to media response and regulatory reporting.

It is everyone’s responsibility to prevent incidents from occurring by following and implementing security policies and procedures. The Information Security department is charged with the tracking of security incidents through completion. The Information Security Manager, as well as the members of the Incident Response team, lead this effort by staying aware of and keeping up-to-date on current industry security incidents, trends, and best practices. Vonage has an extensively defined and mature set of job definitions for personnel who have roles in the security programs. The job reporting structure is defined within the corporate Organizational Chart with clear reporting lines of responsibilities. There is overlap and backup to provide coverage by properly trained and qualified individuals 24/7/365.

Customer Impact and Notification

The mechanics and timing of customer notifications are very situation-dependent. A cyber incident directly impacting customer data may result in a customer-specific communication and dedicated response from our Corporate Communications and/or Legal teams. An incident such as DDoS (which does not impact customer data) may result in a communication that primarily comes from the Account team. 

If a security incident has impacted customer data, the affected customers are notified in a timely and appropriate manner.

Interested Third Party

The Vonage Incident Response team may work with the following third parties depending on the nature of the incident:

• The United Kingdom’s Information Commissioner’s Office, as well other regulatory bodies, to report a breach of personal data.
• Any affected Vonage customer.
• Sub-processors or other service providers.

DATA PRIVACY CONTROLS

Data Classification, Retention, and Destruction

Vonage has documented data classification, retention, and destruction policies and processes that are adhered to by our various business units. Media slated for destruction is stored in secured bins to prevent access by unauthorized personnel, and is destroyed beyond recovery.

The amount of data stored, and retention times for that data, is limited to that which is required for business, legal, and/or regulatory purposes. Physical media scheduled to be destroyed is locked until it is cross-cut shredded, incinerated, or pulped, in accordance with ISO 9564-1 or ISO 11568-3e. Electronic media is destroyed beyond recovery using a secure wipe program to delete files. Visitor logs are shredded after a maximum of one year.

Any media devices such as USB sticks, or external hard drives are not permitted in the data center. Employees are not permitted to copy any customer data onto removable storage devices or any systems and devices that are not approved by Vonage’s IT department.

Cryptographic Key Management

• Keys are generated in appropriate secure environments.
• Stored keys are encrypted using appropriate ciphers.
• Keys are encrypted using a FIPS 140-2 compliant standard or algorithm.
• Keys are rotated at least annually, or when the key is no longer considered secure.

Use of Encryption

• Data is not encrypted while being processed by Vonage systems; other security controls are used to protect the data.
• Sensitive customer data is encrypted using a FIPS 140-2 compliant method when being transmitted across networks.
• Sensitive customer data is encrypted using a FIPS 140-2 compliant method when stored.
• Backups of sensitive customer data are encrypted using FIPS 140-2 compliant methods.

Voice Traffic Confidentiality

Vonage operates a secure core network with edge-based security that prevents unauthorized access to segments of the core network. The Company operates carrier-grade data centers that have strict physical access control. Access to Vonage facilities in these data centers is role-based and restricted to only those employees who need physical access to the Company’s core equipment. The edge of the network is protected by firewalls and SBCs implementing strict access control. As such, capture and replay of voice traffic within Vonage’s core network is protected. The use of encryption from the customer premises is an available option to further protect the confidentiality of customer data.

Vonage employs strict access controls to systems that allow the monitoring, troubleshooting, or replay of customer traffic. Employees who require access to these systems must present a valid business reason and management approval prior to receiving access. Users must leverage a centrally managed authentication system as an additional measure to prevent unauthorized access.

Personnel Access to Secure Premises

While a large portion of the Vonage infrastructure is cloud-based, where physical data centers exist, a stringent policy exists to prevent unauthorized access, loss, or damage to Vonage information resources. The facilities are designed to withstand adverse weather and other reasonably predictable natural conditions; utilize redundant electrical and telecommunications systems; employ environmental systems that monitor temperature, humidity, and other environmental conditions; and contain strategically placed heat, smoke, and fire detection and suppression systems. Facilities are secured by a variety of means, including around-the-clock guards, interior and exterior surveillance systems and cameras, two-factor access screening and door access which includes biometrics, and escort-controlled access. In the event of a power failure, uninterruptible power supply and continuous power supply solutions are used to provide power while transferring systems to onsite back-up generators.

Personnel requiring access to secure facilities are required to wear badges issued by the HR/Facilities departments. The badges are encoded to permit rapid deactivation through an internal system change to prevent further access. Physical access to facilities is extremely limited to Vonage’s Data Center Operations team and select individuals in the Company’s Engineering department. Recording cameras are strategically placed in order to permit investigation of acts detrimental to the facility. Biometric safeguards are also employed to allow access to only those that have the proper authorization.

CHANGE MANAGEMENT

The Vonage Change Management policy aims to ensure that changes made to items that are used to provide Vonage service are tracked and approved by relevant stakeholders to maintain the quality, security, and stability of the Vonage platform.

All changes to production environments are implemented in a controlled manner to minimize risk. The Vonage change management policy and processes enforce industry best practice standards for planning, approving, implementing, and reporting changes to Vonage production environments.

All changes to the production environments are to be documented in an approved change method, and must have been assessed for the following elements:

security risk

• service risk
• implementation plan
• verification steps
• rollback plan
• deployment period
• customer impact assessment
• testing performed
• reviews performed and approvals received

Change request tickets retain the history of the ticket transitions, comments, and modifications, which serves as an audit log of the change request. The expectation is that all employees scheduling and performing changes to production environments will adhere to the change policy. It is also expected that all changes will be properly tested, logged, and authorized in accordance with this standard. A "zero tolerance" policy towards unauthorized changes has been adopted, and to enforce this policy, any unauthorized change(s) will be subject to leadership review, and based upon findings, may result in disciplinary action up to and including termination.

COMPLIANCE CERTIFICATIONS

Visit our security page for more compliance certification information: https://www.vonage.com/security/ 

Vonage holds the following certifications (please refer to each certification document for the exact services they cover): 

VONAGE BUSINESS COMMUNICATIONS

• Enterprise West Platform

  • Certified Payment Card Industry (PCI) Service Provider (via 3rd party Qualified Security Assessor (QSA) organization)
  • Health Insurance Portability and Accountability Act (HIPAA) Compliant (via 3rd party assessor organization) 
  • HITRUST Framework (HITRUST CSF) Certified (via 3rd party assessor organization and HITRUST)

• Vonage Business Cloud Platform

  • Certified Payment Card Industry (PCI) Service Provider (via 3rd party Qualified Security Assessor (QSA) organization)
  • Health Insurance Portability and Accountability Act (HIPAA) Compliant (via 3rd party assessor organization) 
  • HITRUST Framework (HITRUST CSF) Certified (via 3rd party assessor organization and HITRUST)
  • Service Organization Control Type 2 (SOC 2) Type II Certified (via 3rd party assessor organization)

VONAGE CONTACT CENTER (formerly NewVoiceMedia)

• International Organization for Standardization (ISO) 27001:2022 Certified (via 3rd party assessor organization)
• SOC 2 Type II Certified (via 3rd party assessor organization)
• Certified Payment Card Industry (PCI) Service Provider (via 3rd party Qualified Security Assessor (QSA) organization)
• Health Insurance Portability and Accountability Act (HIPAA) Compliant (via 3rd party assessor organization) 

VONAGE VIDEO API

• SOC 2 Type II Certified (via 3rd party assessor organization)
• Health Insurance Portability and Accountability Act (HIPAA) Compliant (via 3rd party assessor organization) 

VONAGE API (Voice/SMS)

• ISO 27001:2013 Certified (via 3rd party assessor organization) (SMS and Voice API)
• SOC 2 Type II Certified (via 3rd party assessor organization) (SMS API Only)
• Health Insurance Portability and Accountability Act (HIPAA) Compliant (via 3rd party assessor organization) (SMS and Voice API) 

VONAGE AI (formerly Over.ai)

• Certified PCI Service Provider (via 3rd party QSA organization)
• SOC 2 Type I Certified (via 3rd party assessor organization)
• Health Insurance Portability and Accountability Act (HIPAA) Compliant (via 3rd party assessor organization) 

VONAGE AI Studio

• Health Insurance Portability and Accountability Act (HIPAA) Compliant (via 3rd party assessor organization) 

Additionally, Vonage is able to execute Business Associate Agreements for the applicable services for organizations with HIPAA requirements.