Question 1

Which PII (Personally Identifiable Information), or other sensitive or confidential information, is required to provide the Inriver PIM service?

Accepted Answer

The Inriver PIM uses only limited personal data (i.e., name and email address) for unique login and roles/permissions assignment. To provide the Inriver PIM service, there is no need to store, process, or transmit any sensitive personal data (such as Social Security Numbers, PCI data, etc.).

Question 2

Is customer data encrypted in the Inriver PIM?

Accepted Answer

Yes. All data is encrypted at-rest and in-transit by default. The Inriver PIM service is encrypted in-transit with at least TLS 1.2, and at-rest with at least AES 256, including redundant backups.

Question 3

Does Inriver have a dedicated information security leader or security team?

Accepted Answer

Yes. Inriver has a dedicated Security and Compliance team that is led by the CISO (Chief Information Security Officer).

Question 4

Do Inriver's information security and privacy policies align with industry standards (such as SOC 2, ISO-27001, NIST Cyber Security Framework, ISO-22307, CoBIT, etc.)?

Accepted Answer

Yes, Inriver has ISO/IEC 27001:2022 and ISO 27701:2019 certification, and Inriver PIM has a SOC 2 Type II attestation.

Question 5

Does Inriver provide SOC 2 reports or similar to customers?

Accepted Answer

Yes. Our recent SOC 2 Type II report is available upon request via the Trust Center and requires the signing of a Non-Disclosure Agreement (NDA).

Question 6

Does Inriver perform penetration testing and vulnerability scanning?

Accepted Answer

Yes. Inriver engages an independent third-party company to perform penetration testing on an annual basis. Vulnerability scans are performed on at least on a weekly basis.

Question 7

Does Inriver have solutions in place for logging, alerting, and responding to relevant security events?

Accepted Answer

Yes. The Inriver PIM leverages Microsoft Azure native solutions for Cloud Security Posture Management (CSPM), Cloud Workload Protection Platform (CWPP), and Security Information and Event Management (SIEM).
Inriver also uses a Managed Security Services Provider (MSSP) / Managed Detection and Response (MDR) company that provides 24/7 SOC (Security Operation Center) continuous security monitoring and threat remediation. For more information, read the Inriver Trust Center datasheet.

Question 8

Does Inriver have a tool in place to monitor secure coding practices and to assess third-party (or open-source) libraries?

Accepted Answer

Yes. There is a static code analysis tool in place that provides reports on vulnerabilities in the source code and as well as third-party (or open source) libraries. The tool also checks code quality and provides suggestions for improvements.

Question 9

How are users authenticated in the Inriver PIM?

Accepted Answer

Users are authenticated via a basic username and password or SSO (Single Sign-On). For SSO, Inriver supports SAML 2.0. This allows us to work with, for example, AD, Azure AD, Okta, and others.

Question 10

Does Inriver vet and manage subcontractors or third parties?

Accepted Answer

Yes. Inriver has a rigorous risk assessment process for evaluating and approving all subcontractors or third parties. For more information, visit the Inriver Trust Center.

Data security for the whole organization

One secure platform for all your data management processes

Inriver PIM: Certified data security and privacy for your Product Information Management

Inriver is part of the Microsoft Azure ecosystem

Inriver data security: 10 frequently asked questions

Which PII (Personally Identifiable Information), or other sensitive or confidential information, is required to provide the Inriver PIM service?

Is customer data encrypted in the Inriver PIM?

Does Inriver have a dedicated information security leader or security team?

Do Inriver's information security and privacy policies align with industry standards (such as SOC 2, ISO-27001, NIST Cyber Security Framework, ISO-22307, CoBIT, etc.)?

Does Inriver provide SOC 2 reports or similar to customers?

Does Inriver perform penetration testing and vulnerability scanning?

Does Inriver have solutions in place for logging, alerting, and responding to relevant security events?

Does Inriver have a tool in place to monitor secure coding practices and to assess third-party (or open-source) libraries?

How are users authenticated in the Inriver PIM?

Does Inriver vet and manage subcontractors or third parties?

See the Inriver PIM in action

You may also like…

Introducing Inriver Trust Center

Download: Gartner Market Guide for PIM solutions

PIM implementation: The complete how-to guide

The State of AI in PIM