Security

Our internal network is protected by an enterprise-grade firewall/IDS/IPS system and we utilize network segmentation to keep the network secure. Our network is protected against DDoS attacks, as well as other well-known network attacks. We routinely scan our internal network for vulnerabilities and document remediations. Access to the production environment is restricted to only authorized IP addresses and requires key authentication on all endpoints. Our public addresses are reviewed on a quarterly basis to ensure a secure production environment.

When a new employee joins Picsart, they complete a mandatory cybersecurity training to bring them up to speed with cybersecurity principles and best practices. We’ve built a custom management learning system to help further educate employees on cybersecurity issues:

• Passwords & multi-factor best practices
• Attack vectors (e.g., phishing, social engineering, malware)
• Device security and how devices should be properly secured and hardened
• Digital footprint (e.g., PII and how it can be easily accessed online, social media best practices)

All Picsart employees complete ongoing training related to cybersecurity and emerging threats to ensure they are well trained and informed about protecting against potential security threats.

Picsart engages a third-party to perform annual penetration testing for applications and all critical services. The objective of penetration testing is to find security vulnerabilities following industry standards and best practices (such as OWASP and OSSTMM). Picsart documents and evaluates any vulnerabilities found by the third-party assessor and then creates remediation plans for fixing them.

Our intrusion detection mechanism takes note of host-based signals on individual devices and network-based signals from monitoring points within our servers. Administrative access, use of privileged commands, and system calls on all servers in our production network are logged. Rules and machine intelligence built on top of this data give security engineers warnings of possible incidents. At the application layer, we have our proprietary WAF which operates on both whitelist and blacklist rules.

All Picsart employees undergo a strict offboarding process that ensures access to systems and client data is removed immediately when an employee leaves or is terminated.

Our framework distributes and maintains the cloud space for our customers. Each customer’s service data is logically separated from other customers’ data using a set of secure protocols in the framework. This ensures that no customer’s data becomes accessible to another customer.

Our security team performs automated and manual application and infrastructure security testing to identify and patch potential security vulnerabilities and bugs on a regular basis. Picsart identifies and mitigates risks via regular network security testing and auditing by both dedicated internal security teams and third-party security specialists.

A formal change management policy has been defined by Picsart’s engineering team to ensure that all changes have been authorized prior to implementation into the production environment. All changes are stored in a version control system and are required to go through automated quality assurance (QA) testing procedures and manual code review to verify that security requirements are met. Successful completion of QA procedures leads to implementation of the change. All QA-approved changes are automatically implemented in the production environment. Our software development lifecycle requires adherence to secure coding guidelines, as well as screening of code changes for potential security issues via our QA and manual review processes.

We use technologies from well-established and trustworthy service providers to prevent DDoS attacks on our servers. These technologies offer multiple DDoS mitigation capabilities to prevent disruptions caused by bad traffic, while allowing good traffic through. This keeps our websites, applications, and APIs highly available and performing.

We utilize data centers that have been thoroughly vetted and have strict physical security controls (e.g. RFID badges, biometrics, barbed wire fences, video surveillance, motion detection, and access logging) to ensure the data centers are secure. The data centers limit access for entry and utilize the principle of least privilege for access. Additionally, we utilize SOC 2 audited/compliant data centers by geographic location whenever available by our data center providers.

All company devices are hardened, adhering to the highest security standards, utilize full-disk encryption, and have MDM software that allows for remote wiping if the device is lost.

Picsart adheres to NIST standards for encryption, utilizing both at-rest and in-transit protection: AES 256 encryption for data at rest and TLS 1.2 or higher for transmission, ensuring that data is secured by the highest industry standards.

Picsart has a documented information security policy that all employees must read and acknowledge. This policy is reviewed and updated annually. Security policy development, maintenance, and issuance is the responsibility of the Picsart Information Security Team.

For US-hosted customers, Picsart hosts the Picsart Services with Amazon Web Services in their US-East-1 region, Virginia, USA. Some Picsart Services may also be hosted on Google Cloud in their East US region.

For Europe-hosted customers, Picsart hosts the Picsart Services with Amazon Web Services in their EU-Central-1 region, Frankfurt area, Germany, with some S3 storage containers in EU-West-1 in Ireland.

Picsart may use one or more third-party content delivery networks to provide the Picsart Services and to optimize content delivery via the Picsart Services. Content items to be served to subscribers or end-users, such as images or attachments uploaded to the Picsart Services, may be cached with such content delivery networks to expedite transmission.

Information transmitted across a content delivery network may be accessed by that content delivery network solely to enable these functions.

Picsart’s CTO is responsible for the overall security of the Picsart Services, including oversight and accountability. Picsart’s contracts with third-party hosting providers such as Amazon Web Services and Google Cloud Platform include industry-standard information protection requirements.

Picsart maintains an inventory of essential information assets such as servers, databases, and information. All Customer Data is classified as “Secret” by Picsart.

Picsart adopts the principle of least privilege for all accounts running application or database services, as well as with its own staff. For example, User Success Managers only have access to the regions for which they are directly responsible. Picsart maintains separate development, staging (or sandbox), user acceptance testing, and production environments; access to each environment and within each environment is strictly controlled.

Access to Picsart’s servers is controlled via revocable SSH keys managed via configuration management and rotated at least annually. All access to Picsart’s servers or Customer Data is logged and can only be accessed through Picsart’s VPN. Database access is controlled via 32 and 64-character passwords with IP whitelisting. Picsart’s HR onboarding and off-boarding processes handle provisioning and de-provisioning of accounts and access.

All employees at Picsart sign a non-disclosure agreement when their employment begins. In addition, Picsart conducts background checks of its employees as part of its onboarding process. All employees are informed of, and agree to comply with, Picsart’s security policies and practices as a part of their initial onboarding.

System administrators, developers and other users with privileged access receive special and ongoing training and are subjected to additional background screening.

Access to Picsart facilities is controlled by 24-hour security. Additionally, all Picsart offices are protected by locked access and are under 24-hour video surveillance. All Picsart employee workstations are encrypted and password protected, and all Picsart user accounts require two-factor authentication.

Data centers and servers are managed and controlled by our cloud hosting providers, GCP and Amazon Web Services. Details regarding the security practices and controls applicable to these facilities can be found at their websites:

AWS security ↗Google Cloud security ↗

The Picsart Services are operated in accordance with the following procedures to enhance security:

• User passwords are never transmitted or stored in clear text
• Picsart uses industry-standard methods to determine password validity
• API key information for third-party services provided by the customer are encrypted for storage
• Picsart keeps audit logs for all access to production servers
• Server access is controlled via public key access, instead of passwords, and only permitted while on VPN
• Logs are stored in a secure centralized host to prevent tampering
• Picsart application and SSH audit logs are stored for one year
• Passwords are not logged under any circumstances
• Access to Picsart mail and document services is only allowed on approved mobile devices that have automated security policies enforced, such as encryption, autolock and passwords
• All access to customer dashboard accounts by Picsart employees must be done through an internal service that is accessible via VPN only
• As part of Picsart’s Employee Information Security Policy, employees may not store any Customer Data on removable media

Picsart monitors system, user, and file behavior across its infrastructure using a host-based Intrusion Detection System. Intrusion Detection alerts are monitored by the Security and Ops monitoring teams 24/7. Additionally, Picsart may analyze data collected by users’ web browsers (e.g., device type, screen resolution, time zone, operating system version, browser type and version, system fonts, installed browser plug-ins, enabled MIME types, etc.) for security purposes, including to detect compromised browsers, to prevent fraudulent authentications, and to ensure that the Picsart Services function properly.

Picsart’s APIs and Dashboard use strict role-based access controls and user permissioning. Unauthorized web requests and API calls are logged and automatically alert Picsart’s engineering team.

All Picsart systems used in the provision of the Picsart Services, including firewalls, routers, network switches, and operating systems log information to their respective system log facility or a centralized syslog server (for network systems) in order to enable security reviews and analysis. Picsart has automated alerts and searches on these logs.

Picsart’s infrastructure and applications are regularly scanned based on the Vulnerability Management Policy. Reports are analysed by our Security Team and addressed at least monthly. Picsart also maintains membership of various CVE vulnerability mailing lists. Patches for ‘critical’ and ‘high’ vulnerabilities are applied no later than 30 days following discovery.

Picsart runs a VDP (Vulnerability Disclosure Program) with HackerOne, which creates clear guidelines for researchers and ethical hackers to submit security vulnerabilities to Picsart while also helping us mitigate risk by supporting and enabling the disclosure and remediation of vulnerabilities before they are exploited.

Picsart also uses static code analysis tools during the build process (such as GitHub Dependabot and the MobSF framework) to perform static security analysis.

Picsart undergoes a third-party penetration test of the Picsart Services on an annual basis.

For technical monitoring, maintenance and support processes, Picsart uses a combination of tools to ensure that processes and servers are running properly, including but not limited to:

• Process monitoring
• CPU, disk, and memory monitoring
• Uptime monitoring
• Functional monitoring
• Database monitoring
• APM performance monitoring
• Error monitoring

The Picsart Services employ a variety of security controls. These include, but are not limited to:

• API IP whitelisting: defines the range of IP addresses from which a customer’s users can access the Picsart API to prevent unauthorized third parties from accessing the Picsart Services.
• Dashboard account IP whitelisting: defines a range of IP addresses from which a customer’s users can access the Picsart Dashboard to prevent unauthorized parties from accessing the Picsart Services.
• Single sign-on with a Google Account: Picsart customers can access the Picsart Services by means of a Google Account, which allows customers to configure such access to require two-factor authentication.
• Single sign-on via Okta: Picsart customers can access the Picsart Services via Okta, which allows customers to configure access via their Okta installation.
• Mobile authenticator: Picsart customers can enable two-factor authentication via Authy, which allows a mobile authenticator to be required for access to the Picsart Dashboard.
• Customer-configurable roles and permissions: Picsart customers have the option to manage their users of the Picsart Services through selective and granular permissioning.
• All requests on the Picsart Dashboard have cross-site request forgery (CSRF) protection. All web services use encrypted HTTPS for all traffic and disallow all HTTP traffic via HTTP Strict Transport Security (“HSTS”).
• Picsart does not use cookies for session storage to avoid replay attacks. Sessions expire after a few hours of inactivity.
• User passwords on the Picsart Dashboard must meet minimum password length requirements. At the customer’s request, Picsart can add password complexity requirements, such as lowercase, uppercase, numeral, and special characters, and set a password expiration policy such that users must change their passwords regularly.
• User password history of the last six passwords prevents the reuse of user passwords.
• Failed login attempts are recorded and an account is locked out with the owner notified after multiple failed attempts.
• Picsart’s REST APIs are accessed with separate API keys, which can only be provisioned by Picsart dashboard user accounts with administrative access. API keys are granted access to specific API endpoints when created.

Picsart uses tools such as GitLab and Jenkins to effectively manage the development lifecycle. During testing, Picsart generates sandbox accounts and fake data for testing. Picsart does not use production data in sandbox accounts.

Application source control is accomplished through private GitHub repositories. Picsart has controls in place to ensure that all code must be approved before being merged to Picsart’s main code branch; only the CTO and approved employees are granted access to promote code to production.

Picsart developers receive additional security training as part of their onboarding, and undergo regular and periodic security training during the term of their employment. Picsart maintains a list of core security principles for engineering and high-level guidelines on security topics for secure software development.

As a mitigating factor against malware, all Picsart servers run LTS editions of operating systems, as well as endpoint monitoring and antivirus services.

Picsart adopts the principle of least privilege for all accounts running application or database services. Proper change management ensures that only authorized packages are installed via a package management system containing only trusted software, and that software is never installed manually.

All Picsart employee computers have virus scanners installed and updated definitions sent out from a central device management platform.

Picsart maintains written and regularly-audited security incident management policies and procedures, including an Incident Response Plan to be enacted in the event of an incident.

Picsart has 24x7x365 on-call incident management staff.

The Picsart Services use industry-accepted encryption practices to protect Customer Data and communications during transmissions between a customer’s network and the Picsart Services, including 256-bit TLS Certificates and 2048-bit RSA public keys at a minimum.

Picsart audits the TLS ciphers used in connection with the provision of the Services with third-party security auditors to ensure that anonymous or weak ciphers are not used. These audits also confirm that the Services do not allow client renegotiation, support downgrade attack protection and forward secrecy.

Data shipped to Amazon Web Services is encrypted in transit and at rest using AES-256 encryption via Amazon’s managed encryption key process. Data shipped to databases is encrypted at rest using AES-256 encryption via the LUKS encryption process.

Where use of the Services requires a customer to provide access to third-party services (for example, AWS S3 credentials for data exports), Picsart performs additional encryption of that information.

The Picsart Services allow import, export, and deletion of Customer Data by authorized users at all times during the term of a customer’s subscription. Following termination or expiration of the Services, Picsart shall securely overwrite or delete Customer Data within 60 days following any such termination, in accordance with the Agreement, applicable laws and the Documentation.

All networking components, SSL accelerators, load balancers, web servers and application servers are configured in a redundant configuration. All Customer Data submitted to the Picsart Services is stored on a primary database server with multiple active clusters for higher availability. All database servers replicate in near real-time and are backed up on a regular basis. Backups are encrypted using AES-256 encryption and verified for integrity.

Picsart has a written Business Continuity and Disaster Recovery Plan, which is tested annually. Picsart tests database backups and failovers as part of our Business Continuity Plan. Backups are encrypted and stored in Amazon Web Services.

Picsart uses Mobile Device Management (“MDM”) platforms to control and secure access to Picsart resources on mobile devices such as phones, tablets, and laptops. Picsart uses Google for its phone and tablet MDM policy, and enforces common security settings such as, but not limited to, encryption, lock screen passwords, password expiration, display timeouts, and remote location and remote wipe. Picsart uses Cisco Meraki for laptop and desktop management to enforce common security settings, including but not limited to, hard disk encryption, security patches, and remote location and remote wipe capabilities.

The Picsart Services have not been designed to include any backdoors or similar functionality that would allow the government or any third parties to access Customer Data. We do not voluntarily provide any government or other third party with encryption keys, or any other way to break our encryption.

Picsart outsources its payment processing to third-party payment processors which are PCI DSS (Payment Card Industry Data Security Standard) compliant.

All data stored by Picsart on behalf of customers has strong tenant isolation security and control capabilities. Picsart Services utilize Amazon S3, which provides advanced data access controls.

Picsart’s Security Team can be reached by emailing [email protected].