Security at Market4Play

Market4Play is dedicated to prioritizing security to ensure the swift delivery of delightful results to our customers. We have implemented rigorous security protocols throughout the development of our product, encompassing its creation and data management processes. Our platforms have enabled numerous conversions for our customers while maintaining exceptional uptime. We are committed to instilling a sense of safety and confidence in both our customers and their clientele as they engage with our services.

Legal ResourcesClick here

Sales & SupportClick here

To address any security inquiries or feedback, please submit an email ticket to our dedicated security team. Security-related tickets are promptly prioritized and addressed to ensure swift resolution. Rest assured, our security team will be promptly notified and may directly engage with you regarding your concerns

Market4Play's Resilient Infrastructure

At Market4Play, safeguarding against potential threats is not just a priority, it's a proactive commitment. While our robust protocols are designed to thwart attacks, we go further by implementing preemptive measures to minimize potential harm. One key tactic is our system compartmentalization, where each system exclusively hosts a single application—a concept known as "single-use systems." This deliberate segmentation acts as a buffer, containing any breaches and limiting their impact across our infrastructure. Moreover, our systems are architected to be transient and ephemeral. Data transiently traverses between systems, with each instance operating for a brief period, typically no more than a week. This dynamic strategy, outlined in our Release Management protocols, empowers us to swiftly identify and address security incidents. Additionally, our systems are immutable, meaning that once deployed, neither the system configuration nor the installed software can be altered. This unyielding stance ensures system stability and enables proactive monitoring for any indications of compromise.

Fortifying Defenses Against Threats

Market4Play fortifies its servers within a secure virtual network enclave on Google Web Services, ensuring encrypted communication and isolation from public Internet exposure. SSL encryption upholds security standards for external communication. Strict port policies and resilient firewalls govern network access, complemented by a "default deny" approach to thwart intrusion attempts. Multi-layered authentication and stringent password protocols further enhance network security.

Vigilant Monitoring Framework

Market4Play's logging framework securely stores data in a centralized repository, adhering to industry compliance standards for extended data retention. Event data is transmitted to a third-party service via a write-only event stream, ensuring uninterrupted monitoring without compromising system integrity.

Commitment to Compliance

Market4Play ensures compliance with various standards, including PCI, to safeguard customer data. Over 100 security controls are in place to prevent unauthorized access. We stay vigilant about evolving EU data privacy regulations to ensure ongoing compliance and maintain customer trust.

Data Authorization

Market4Play strictly controls access to customer and non-public data, permitting only authorized personnel based on business necessity. Access privileges are regularly reviewed and promptly revoked when no longer required or upon employee departure.

Data Encryption at Rest

Market4Play classifies data based on sensitivity levels, ensuring that all highly sensitive information is encrypted when at rest. Access to such data is restricted to authorized users with legitimate business purposes.

Data Encryption in Transit

Market4Play employs industry-standard SSL encryption for all interactions with its platform, guaranteeing secure communication between users and services. Payment card information is exclusively transmitted via secure channels to prevent exposure to insecure communication methods.

Encrypted Inter-System Communication: Market4Play enforces encryption for all internal and external system communications, safeguarding data integrity across all interactions, whether internal or external.

External Security Assurance

External Penetration Testing: Market4Play conducts regular external penetration tests on its application to validate the effectiveness of its security measures in safeguarding customer data. These tests are carried out by impartial third-party security firms to ensure objectivity and thoroughness.

Restrictions on Security Audits: Market4Play strictly prohibits any unauthorized security audits, scans, or penetration tests as outlined in our Acceptable Use Policy. This policy applies universally to all systems and services managed by Market4Play. In the event of unauthorized scans, we reserve the right to take legal action and may block the source IP address(es) to protect our systems and maintain service availability for all customers.

Incident Management and Remediation

Preparedness for System Failures: At Market4Play, we acknowledge the inevitability of system failures and take proactive measures to mitigate their impact. Our incident response strategy prioritizes swift action to minimize disruptions and ensure rapid recovery.

Transparency and Notification: Despite maintaining over 99% uptime, occasional failures may occur. In such instances, customers are promptly notified via our status page at https://market4play.instatus.com, ensuring transparency and keeping users informed of any service disruptions.

Continuous Improvement: Market4Play employees adhere to meticulous incident response procedures, emphasizing the importance of honest feedback sessions, known as post-mortems. These sessions facilitate a deeper understanding of system failures and enable proactive measures to prevent recurrence in the future

Retention of Data Policy

Customer data remains accessible only to the customer or upon their request for deletion. Our system employs a soft delete method, rendering data invisible to the application while retaining it in the database for potential restoration. Additionally, data is preserved in backups to support disaster recovery procedures. Even if data undergoes a hard delete from our systems, it remains in backups for a brief period, approximately two weeks. Logs, containing potentially identifying information of customer data within our system, are retained for one year. These logs serve auditing and troubleshooting purposes.

Information Integrity Framework

At Market4Play, preserving the integrity of information remains our foremost commitment, ensuring the seamless management of customer data across our systems. This pledge extends internally within Market4Play services and externally with our esteemed clients. We firmly adhere to the principle that all external data sources undergo rigorous scrutiny before being deemed reliable. In maintaining our steadfast devotion to security, each alteration to the Market4Play platform undergoes thorough examination for outdated or compromised libraries and code segments. Moreover, our operational environment undergoes constant monitoring for common security vulnerabilities, as outlined by the OWASP Top 10 standards, with swift resolution of any identified concerns.

In maintaining our steadfast devotion to security, each alteration to the Market4Play platform (app.market4play.com) undergoes thorough examination for outdated or compromised libraries and code segments. Moreover, our operational environment undergoes constant monitoring for common security vulnerabilities, as outlined by the OWASP Top 10 standards, with swift resolution of any identified concerns.

Software Development Cycle and Release Oversight

Before any software alterations are made accessible to the public, they undergo rigorous peer review and testing. Similarly, infrastructure modifications are encoded, facilitating review and testing prior to deployment. Our approach to release management for each service centers on immutable architecture, where every new code iteration is constructed atop a pristine, fully-updated server and infrastructure ensemble. In the event of code flaws, servers are promptly decommissioned.

New software rollouts occur as necessary, frequently occurring multiple times daily. We advocate for incremental changes to minimize the likelihood of failures and expedite recovery in the event of unforeseen issues.

Common Security Vulnerabilities

Injection Attack Mitigation

All incoming data, whether from customers or external sources, undergoes stringent validation against a whitelist before integration into databases or other systems. Additionally, our application ensures that data output from databases is properly sanitized to prevent inadvertent insertion of injection data.

Preventing Cross-Site Scripting (XSS)

To thwart XSS exploits, all user input is meticulously escaped. Furthermore, automated security scanners continuously assess and target this specific vulnerability.

Enhanced Authentication and Session Handling

We enforce encrypted transmission of authentication credentials over SSL and maintain secure access to cookies

Guarding Against Cross-Site Request Forgery (CSRF)

All forms within our application mandate CSRF tokens, verified through an automated scanner dedicated to this vulnerability.

Robust Security Configuration Management

Market4Play systems receive regular updates incorporating the latest patches and code for both operating systems and vendor software. Rigorous security hardening procedures are applied to all systems, and all configuration changes undergo peer review before deployment.

Effective Cryptographic Key Management

Passwords are hashed using bcrypt with an elevated work factor to deter brute-force attacks. Customer passwords remain inaccessible to Market4Play employees at all times.

Ensuring Transport Layer Protection

Market4Play prioritizes security by encrypting all communication between customer browsers and the Market4Play app (app.market4play.com) using industry-standard SSL protocols. We conduct regular reviews of cipher suites and protocols to uphold stringent security standards. Additionally, landing pages published by customers can be served over SSL to guarantee secure transmission of form submissions. We strongly advise customers to prioritize SSL for enhanced security measures.