Security Overview

Lucky Orange takes data security and visitor privacy very seriously. There are a number of steps and features unique to the Lucky Orange platform that ensure your data is safe and secure, and your visitors' privacy is respected.

Sensitive data should never leave the visitor's computer

One important distinction of Lucky Orange is that we do not allow the transmission of sensitive data to our servers. Our goal is to give you the insight needed to properly analyze your visitors' behaviors without the need for ever sending or storing sensitive information.

Lucky Orange has several methods of helping you prevent transmission of sensitive data from your visitor's computer. By employing these techniques you can ensure that sensitive data never leaves the browser, never transmits over the internet, and never reaches our servers. Some of these methods include:

• An opt-in approach to keystroke logging
• Marking sensitive HTML content with special CSS classes
• Scrambling all page text content with the push of a button

Google Cloud and AWS compliance and security

Lucky Orange core services are hosted on Google Cloud Platform (GCP), and therefore leverage the enormous amount of work Google itself makes in security to the benefit of our customers. Several secondary systems (such as our CDN) are powered by Amazon Web Services (AWS), and leverage all the security and compliance provided by AWS.

Physical security

Lucky Orange production data is processed and stored within state-of-the-art data centers, which uses a layered security model, including safeguards like custom-designed electronic access cards, alarms, vehicle access barriers, perimeter fencing, metal detectors, and biometrics, and the data center floor features laser beam intrusion detection.

Data storage

All persistent data is encrypted at rest using the AES-256 standards or similarly high standards, allowing Google Cloud Platform to have successfully completed ISO 27001, ISO 27017, ISO 27018, PCI DSS 3.2, SSAE-16, SOC 1, SOC 2, and SOC 3 certifications. See Google Cloud Security Compliance. 

Unless on a custom plan or explicitly stated elsewhere, our data is processed and stored in GCP in the United States via the us-central1 region.

GDPR Compliance

Lucky Orange's proactive approach to treating data as sensitive has allowed our collection process to be GDPR compliant well in advance of the regulation live as of May 2018.  To read more about the steps we are taking, you can find it here.

Encryption in transit and at rest

Lucky Orange will encrypt all data transmitted from your visitor's browsers to our servers as well as when the data is stored at rest in GCP. Even if your website does not employ HTTPS (secure) encryption, our data will still be transmitted via an HTTPS (secure) connection.

Servers and networking

All production systems are running recent, continuously patched versions of linux or Kubernetes Container-Optimized OS. Additional hosted services, such as Google Cloud Bigtable, are comprehensively hardened Google infrastructure-as-a-service (IaaS) platforms.

Least privilege and access to production data

We follow the principle of least privilege in producing software as well as restricting access of employees to production data based on their role. For employees that do have access to production systems, access is limited to specific whitelisted IP addresses and two-factor authentication is required.

Code reviews and automated testing

All commits to production source code are subject to code review by a qualified developer, staging server reviews, as well as a multitude of automated unit and end-to-end tests.