Confidence by Spotify Security

Information security is important to us

Confidence maintains a comprehensive security program that implements appropriate administrative, technical, and physical security controls to protect the security, confidentiality, and integrity of data.

Security Program Governance

Personnel Security

Personnel receive regular training on essential security best practices, covering topics such as insider threat prevention, access control, data protection, and the confidentiality of data as required by applicable laws and regulations.

Third-Party Management

A vendor assessment process evaluates suppliers and third-party vendors. System development outsourced to third parties follows practices no less stringent than those described on this page.

Technical Controls

Cloud Operating Model

We operate under a Shared Responsibility Model with Google Cloud Platform (GCP). GCP secures the underlying cloud infrastructure and Confidence is responsible for securing the system deployed within GCP.

Access and Authentication

Access is granted on a need-to-know basis: only developers working on Confidence have access to production systems. Two-Factor Authentication (2FA) is mandatory for personnel accessing source code and data. Access for employees and subcontractors is automatically added and removed when they join or leave the project. Access is managed via an Identity and Access Management (IAM) system and reviewed periodically.

Network and Data Protection

Standard security practices are employed, including encryption at rest and in transit, data isolation, automated logging and monitoring, and automated daily backups to ensure recoverability.

Risk Management

Application Security

Secure coding principles are used throughout the software development lifecycle (SDLC), including security guidance, source code control to track changes and assist in bug remediation, automated code and dependency vulnerability scanning, and a change management process.

Vulnerability Management

We perform continuous automated scans and conduct annual penetration testing by a third-party vendor to identify security weaknesses. Weaknesses are remediated in accordance with established security policies.

Incident Response

Security Incident Management

A formal written Incident Response Plan (IRP) describes the processes and procedures for assessing and responding to potential security incidents.

Coordinated Vulnerability Disclosure

We collaborate with vulnerability finders and share information with relevant stakeholders such as vendors and customers. Software vulnerabilities are disclosed to the public once a fix has been developed, patched, or mitigated through a different solution.

Business Continuity

Service continuity is ensured through distributed demand, load balancing, DDoS protection, and automated failover. Annual company-wide and product-specific recovery exercises are conducted to validate resilience against regional outages.

Compliance and Attestation

Confidence is currently undergoing a SOC 2 examination relevant to the Security Trust Service Criterion, conducted by a third-party auditor. To request more information, contact confidence-support@spotify.com.

Customer Support

Support is provided via email at confidence-support@spotify.com.

Questions?

If you have any questions about our security, reach out to confidence-support@spotify.com.