
Conductrics is a privacy-conscious A/B testing and optimization platform offering dedicated server environments with customer-controlled data residency and optional self-hosting capabilities. The platform provides privacy-by-design architecture with minimal data collection, enterprise access controls, and maintains an independently reviewed Comply.org Trust Center with verified data protection principles.
Independent legal assessment conducted by CIPP/E certified attorney validating data protection principles, DPA compliance, data processing activities, breach notification obligations, data subject request handling, and regulatory alignment with privacy frameworks.
Independent legal assessment by CIPP/E certified attorney (IE4322) validating data protection principles (Data Minimization, Accountability, Security, Individual Participation, Purpose Limitation, Storage Limitation), DPA compliance, data processing activities, and regulatory alignment. Latest review: July 2024.
Independent technical assessment conducted by CIPT certified privacy engineer validating security measures, technical controls, architecture security, subprocessor management, auditing capabilities, and implementation of security best practices across infrastructure and operations.
Independent technical assessment by CIPT certified privacy engineer (PE4951) validating security measures, technical controls, architecture security, subprocessor management, auditing capabilities, and implementation of security best practices. Latest review: July 2024.
Governance framework establishing data lifecycle management procedures including collection, storage, processing, sharing, retention, and secure disposal with data classification standards, quality controls, and privacy protection measures.
Governance framework for data lifecycle management including collection, storage, processing, sharing, retention, and disposal. Implements Data Quality and Data Minimization principles verified through Comply.org review with classification standards and privacy protection measures.
Executive-approved security framework establishing incident detection, analysis, containment, eradication, and recovery procedures with defined roles, communication protocols, and post-incident review processes for effective security incident management.
Established procedures for handling data subject requests including access, rectification, erasure, portability, and objection rights. Defines response timelines, verification processes, and escalation procedures for GDPR compliance with individual participation principles.
Executive-approved governance framework establishing security objectives, risk management approach, and mandatory controls for data protection, access management, incident response, and security awareness across all organizational functions and personnel.
Executive-approved governance framework establishing security objectives, risk management approach, and mandatory controls for data protection verified through Comply.org review. Covers Security core principle validation including access management, incident response, and security awareness across organizational functions.
Comprehensive privacy policy outlining data collection, processing, storage, and sharing practices, user rights, and privacy safeguards to ensure transparent and compliant data handling practices.
Privacy policy outlines data collection practices including device information (IP address, browser, timezone) and request information (email, phone). Policy emphasizes minimal data collection and includes GDPR rights for European residents. Contact: info@conductrics.com, 222 Broadway, New York, NY 10038.
Organizational policy establishing framework for identifying, assessing, and managing security risks across all business operations, defining risk tolerance levels and mitigation strategies to protect organizational assets and objectives.
Organizational policy for identifying, assessing, and managing security risks across business operations. Supports Accountability principle verified through Comply.org review with defined risk tolerance levels and mitigation strategies for protecting organizational assets.
Formal process for notifying affected parties and authorities in the event of a data breach, including notification timelines, content requirements, and regulatory compliance procedures for breach response.
Documented obligations and procedures for notifying data breaches to supervisory authorities and affected data subjects. Includes incident response timelines, breach assessment criteria, and communication protocols aligned with GDPR Article 33/34 requirements.
Legal agreement establishing data processing terms, responsibilities, and safeguards between data controller and processor, ensuring compliance with data protection regulations and defining data handling requirements.
Comprehensive Data Processing Agreement (DPA) covering data processing activities, data types and categories, processor responsibilities, and controller-processor relationship. Establishes legal framework for GDPR and privacy compliance with documented safeguards and data handling requirements.
Designated data protection officer (DPO) responsible for overseeing data protection compliance, providing privacy guidance, and serving as a point of contact for data protection matters and regulatory inquiries.
Data Protection Officer (DPO) designated for privacy compliance oversight and data subject inquiries. Contact: info@conductrics.com. Headquarters: 222 Broadway, New York, NY 10038. Supports GDPR data subject rights including access, rectification, erasure, and objection.
Regional data storage options enabling customers to host content in specific geographic regions to meet data sovereignty requirements and compliance with local regulations.
Dedicated server environments with customer choice of primary geo-region and major cloud provider. Each customer receives their own dedicated environment ensuring data is never co-mingled with other companies' data. Updates and improvements applied at customer convenience.
Configurable data retention policies enabling organizations to control data lifecycle, including zero data retention options for compliance requirements and data sovereignty needs.
Data retention policies aligned with storage limitation principle ensuring data is kept only as long as necessary for specified purposes. Includes retention schedules, deletion procedures, and regular data lifecycle reviews for compliance with privacy frameworks.
Logical separation controls ensuring customer data cannot leak into training datasets, with dedicated data processing pipelines that maintain strict separation between training data and enterprise customer data.
Data isolation architecture where each customer receives a dedicated environment with data never co-mingled or stored alongside other companies' data. Ensures logical and physical separation of customer data across the platform infrastructure.
Enterprise-grade access controls including multi-factor authentication, single sign-on (SAML SSO), and role-based access controls for comprehensive user management and security.
Team-based organization with role-based access controls allowing granular permissions management. Supports Two-Factor Authentication (TOTP 2FA/MFA) with optional requirement for additional 2FA during production deployment. SSO via SAML also supported for enterprise authentication integration.
Regular systematic evaluations of potential threats and vulnerabilities that could impact organizational objectives, including asset identification, threat analysis, vulnerability assessment, impact analysis, and risk treatment recommendations with documented methodology and review processes.
Regular systematic evaluations of potential threats and vulnerabilities including asset identification, threat analysis, and impact analysis. Supports Accountability principle and Auditing Options from Comply.org review with documented methodology and review processes.
Mandatory employee education program covering cybersecurity best practices, threat recognition, and incident reporting, required within 30 days of hire and annually thereafter to maintain security-conscious workforce.
Employee education program covering cybersecurity best practices, threat recognition, and incident reporting. Supports Security principle verified through Comply.org technical review with mandatory training requirements for maintaining security-conscious workforce.
Formal agreement defining service performance standards, availability commitments, response times, and remediation procedures to ensure reliable service delivery and customer satisfaction.
Service Level Agreements (SLAs) available upon request to define service performance standards, availability commitments, and support response times. Customers should contact Conductrics to discuss specific SLA requirements for their operations.
Comprehensive supply chain risk management program including security controls governing third-party relationships, vendor security assessments, and ongoing monitoring of external parties to ensure security posture compliance.
Comprehensive supply chain risk management program governing third-party relationships with vendor security assessments and ongoing monitoring. Supports Subprocessors management validation from Comply.org technical review ensuring external parties maintain security posture compliance.
Formal contractual agreements with external vendors, suppliers, and service providers that include security requirements, data protection clauses, compliance obligations, and accountability measures to ensure comprehensive third-party risk management and governance.
Formal contractual agreements with external vendors and service providers including security requirements, data protection clauses, and compliance obligations. Supports Subprocessors and Data Transfers verification from Comply.org DPA analysis with comprehensive third-party governance.
Formal vulnerability management process including regular vulnerability assessments, patch management with documented SLAs, vulnerability prioritization and remediation based on severity levels, and continuous monitoring of security vulnerabilities.
Formal vulnerability management process including regular assessments, patch management, vulnerability prioritization and remediation based on severity. Supports Security Measures verification from Comply.org technical review with continuous monitoring of security vulnerabilities.
Cloud infrastructure provider hosting applications, databases, and data storage. Critical infrastructure supporting compute, storage, and AI/ML services with global data residency controls.
Cloud infrastructure provider hosting customer dedicated environments with customer-selected geo-regions. Provides compute, storage, and database services for Conductrics platform. Each customer has their own isolated environment with data residency controls based on customer preference.
Primary cloud infrastructure provider hosting all application services, databases, and data storage. Critical infrastructure supporting 99.99% uptime requirements with global data residency controls.
Cloud infrastructure provider hosting customer dedicated environments with customer-selected geo-regions. Provides compute, storage, and database services for Conductrics platform. Each customer has their own isolated environment with data residency controls based on customer preference.
Website and application analytics tracking user interactions, page views, and conversion events. Collects behavioral data for marketing optimization and product improvement insights.
Used for website analytics to understand how customers browse and interact with the Conductrics website. Users can opt-out of Google Analytics tracking via https://tools.google.com/dlpage/gaoptout. Conductrics may use similar analytics technology as alternatives.