Data Security

1. Our Security Approach

Vista Funnel applies security controls based on the nature and sensitivity of the information involved, the systems processing that information, and the services being provided.

Our approach includes controls relating to access management, authentication, network protection, endpoint protection, data protection, credential security, monitoring, vulnerability management, incident response, and secure data disposal.

2. Access Control and Least Privilege

Access to sensitive information is provided according to job responsibilities and legitimate business requirements.

Vista Funnel seeks to follow least-privilege principles so that personnel receive only the level of access reasonably necessary to perform their authorized duties.

• Access is restricted to authorized users.
• User permissions are based on business requirements.
• Marketplace access is provided only where authorized by the client.
• Access permissions are reviewed and updated when responsibilities change.
• Access should be removed when it is no longer required.

3. Authentication and Credential Protection

Vista Funnel uses authentication and credential-management practices designed to reduce unauthorized access to systems and marketplace accounts.

Users are expected to maintain secure passwords and protect authentication credentials from unauthorized disclosure.

Credentials used to access sensitive systems should not be exposed in public repositories, unsecured documents, or other unauthorized locations.

4. Network and Endpoint Security

Vista Funnel uses network and endpoint security controls designed to protect systems that access or process sensitive business and marketplace information.

Such controls may include network firewalls, endpoint-security technologies, anti-malware controls, restricted network access, security configuration, and other safeguards appropriate to the system and data involved.

Our public website uses HTTPS to help protect information transmitted between visitors and the website.

5. Encryption and Protection of Information

Vista Funnel applies encryption and other protective measures where appropriate or required based on the sensitivity of the information, contractual requirements, marketplace requirements, and applicable law.

Sensitive information transmitted over public networks is expected to use secure encrypted communication protocols.

Credentials, authentication information, and other sensitive data should not be stored or transmitted in unprotected plaintext where applicable security requirements require encryption.

7. Logging and Monitoring

Security logging and monitoring may be used to help detect unusual activity, unauthorized access attempts, system events, operational issues, and potential security incidents.

Relevant logs and security events may be reviewed as part of operational monitoring, security investigations, troubleshooting, and compliance activities.

8. Vulnerability Management

Vista Funnel maintains processes intended to identify, evaluate, and address security vulnerabilities affecting systems involved in delivering our services.

Depending on the system and applicable requirements, vulnerability management activities may include security updates, vulnerability scanning, configuration reviews, remediation tracking, and security testing.

Higher-risk findings are prioritized based on their potential impact and applicable security requirements.

9. Security Incident Management

Vista Funnel maintains procedures for identifying, escalating, investigating, containing, and responding to suspected security incidents.

Appropriate personnel are responsible for coordinating security incident response activities.

Where a security incident affects information subject to legal, contractual, or marketplace notification requirements, Vista Funnel will take appropriate notification and remediation steps in accordance with the applicable requirements.

10. Data Minimization and Retention

Vista Funnel seeks to collect and retain only the information reasonably necessary for an authorized business purpose.

Information is retained only for as long as reasonably necessary to provide services, satisfy contractual or legal obligations, resolve disputes, maintain legitimate business records, or comply with marketplace requirements.

Where Amazon or another applicable requirement specifies a deletion period, Vista Funnel follows the applicable retention and deletion requirement.

11. Secure Data Deletion

When information is no longer required or deletion is requested and applicable, Vista Funnel takes reasonable measures to delete, anonymize, or securely dispose of eligible information.

This may include removal from active systems and other appropriate disposal measures depending on the nature and location of the information.

Information may be retained where retention is required by law, accounting obligations, security requirements, dispute resolution, or another applicable legal or contractual requirement.

12. Employees and Contractors

Employees and authorized contractors who may access sensitive information are expected to follow applicable confidentiality, privacy, access-control, and security requirements.

Access should be limited to information required for assigned duties, and sensitive marketplace or client information should not be used for unauthorized purposes.

13. Third-Party Service Providers

Vista Funnel may use third-party technology and service providers to support business operations and service delivery.

Where such providers process sensitive information on our behalf, we seek to use providers appropriate to the nature of the service and to apply suitable contractual, confidentiality, and data-protection requirements.

Third-party providers are expected to process information only for authorized purposes associated with the services they provide.

14. Client Responsibilities

Clients also play an important role in protecting their marketplace accounts and information.

Clients should:

• Provide access only through approved and authorized methods.
• Maintain secure account credentials and authentication methods.
• Remove access that is no longer required.
• Notify Vista Funnel promptly if unauthorized activity is suspected.
• Review marketplace permissions and user access regularly.

15. Security Program Review

Security practices are reviewed as technology, business operations, marketplace requirements, and security risks evolve.

We may update security procedures and controls where appropriate to address changes in applicable contractual obligations, marketplace policies, legal requirements, or identified risks.