Information Security White Paper commercetools platform This white paper applies to the commercetools platform running in Europe, the US and APAC

www.commercetools.com Table of Contents

Introduction 3

What is commercetools? 4

Security Culture 4 Information Security Management Information Security Controls Human Resource Security

Physical Security 5 Data Center Offices

commercetools Platform 6 System Overview API Security Payment API Product Security Data in Transit Data at Rest Data Access Restrictions Separation of Production and Non-Production Environments

Operational Security 8 Network Security Vulnerability Management Patch Management Malware Prevention Monitoring Incident Management

Security in Development Process 10

Performance Management 10

Data Backup and Business Continuity Management 10

Supplier Relationships 11

Compliance 11 Data Processing Agreements International Data Transfer Data Protection Officer Information Security Certifications

Conclusion 12 About commercetools

commercetools is the world’s leading platform for next-generation B2C and B2B commerce. To break the market out of being restrained by legacy suites, commercetools invented a headless, API-first, multi-tenant SaaS commerce platform that is cloud-native and uses flexible microservices. Using modern development building blocks in a true cloud platform provided by commercetools, customers can deliver the best commerce experiences across every touchpoint on a large scale.

commercetools has offices across the US, Europe, and Asia Pacific, with headquarters in . Since its founding in 2006, commercetools software has been implemented by Fortune 500 companies across industries, from retail to manufacturing and from telecommunications to fashion.

www.commercetools.com - - Jena - - London - Durham NC - Singapore -

Information Security White Paper commercetools platform 13