--- title: Security | Pursuant description: Security | Pursuant ---   # Data Protection Policy     LAST UPDATED: JANUARY 29, 2020 **1. DEFINITIONS ** *Highly Sensitive Information (HSI) – *Social Security numbers, Driver’s License numbers, credit/debit card numbers, checking/savings/bank account numbers, etc.  *Allowed Personal Health Information (PHI) *– As defined by HIPAA: Name(s), address(es), telephone number(s), electronic mail address(es), any other contact information, age, gender, date of birth/death, facsimile number(s), web universal resource locators (URLs), internet protocol (IP) address number(s), client record identification number(s), date(s) of healthcare provided, department(s) of service, treating physician(s), outcome information, and health insurance status.  *Confidential Information (CI) *– Includes all *Allowed PHI*. Also includes financial information such as donation amounts and donor demographic information as related to fundraising communications.  *Data Team *– The tightly controlled list of employees with access to *Confidential Information*.  *SFTP *– Secure File Transfer Protocol. An encrypted and controlled method by which *Confidential Information *may be securely sent or received.  *External Storage *– Storage devices such as USB Drives, CD/DVDs, SD Cards, etc., as well as cloud storage services such as DropBox, Apple iCloud, Personal Google Drives, etc.  *DoD 5220.22-M *– Standard method of data sanitation as described by the U.S. National Industrial Security Program Operating Manual published by the U.S. Department of Defense  **2. DATA HANDLING** Pursuant’s policy is to never receive or handle, whether from a client or produced internally, *Highly Sensitive Information*. Pursuant only accepts data related to fundraising communications (as outlined in HIPAA Subpart E – §164.514(f)). If any **non**–*Allowed PHI *is received or produced for any reason, it is to be immediately reported and destroyed per the **Data Destruction **section outlined in this document.)  *Confidential Information (CI) *is only allowed to be sent or received to/from clients through *SFTP*. When *CI *is received by Pursuant, or created while conducting official business, Pursuant will maintain this information as confidential. All employees are instructed and trained to recognize this information as sensitive and to hold it in strictest confidence. *CI *is only allowed to be accessed by, and stored on the systems of, employees that are members of the *Data Team*, as is necessary for their job function. *Data Team *systems are fully encrypted and transferring of *CI *to unencrypted *External Storage *or systems is not allowed.  **3. DATA STORAGE** *Confidential Information *is only stored while the relevant parties or clients have an active relationship with Pursuant. Once *CI *is no longer necessary to Pursuant business functions, it is kept only as long as is required by federal and state law for the purposes of record keeping in the event of future litigation. Portions that are not relevant to that purpose or *CI *that is older than what is legally relevant is destroyed per the **Data Destruction **section outlined below.  All Pursuant data, including *CI*, is stored on servers and systems that are kept physically secured within the Pursuant office behind multiple locks, access to which is tightly controlled. These systems are also under 24/7 video surveillance. Off-site backup data is stored securely in Amazon S3 Glacier cloud-based storage through AWS. More information about Amazon S3 Glacier storage can be found in the **Important Links **section below.  **4. ACCESS CONTROL** Only Pursuant employees and contractors who have been trained on and accepted the Information Security Policy may access data on Pursuant systems. *Confidential Information *is only accessible by members of the *Data Team*. The *Data Team *is audited and controlled on a continual basis, ensuring that only employees who absolutely require access to *CI *in order to complete their job functions are granted that access. Any attempts to gain access to *CI *by any individual outside of the *Data Team *will result in an immediate alert to IT staff. Terminated employees and contractors are immediately removed from access upon termination.  Clients may request a list of the names of all individuals who have access to their data at any time. **5. DATA DESTRUCTION ** Special care is given to ensure *Confidential Information *is destroyed in such a way that it cannot be recovered. Any *External Storage *media that contains *Confidential Information *is wiped in accordance with the *DoD 5220.22-M *Standard and subsequently physically destroyed and rendered inoperable. Any *CI *that must be destroyed which resides on internal Pursuant storage systems is permanently deleted directly from that location. Any system or data backups that contain destroyed *CI *are allowed to hold that data until it is naturally overwritten by the backup cycle.  **6. BREACH PROTOCOL** In the event of a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to *Confidential Information*, immediately upon discovery, Pursuant will assess the scope of the breach and begin work to contain the breach and limit further compromise of data as much as possible. Immediately after determining the scope of data potentially compromised by the breach, Pursuant will notify all affected parties. The communication sent will include the scope of the breach and what steps Pursuant is taking to ensure the breach is contained. Pursuant will maintain an open dialog with all affected parties throughout the entire breach management process. Once the cause of the breach has been determined, Pursuant will put controls, policies, and/or procedures in place to better secure the environment against future breaches.  **7. IMPORTANT LINKS** **Pursuant Information Security Policy **(Permission to view granted by request only) – [https://drive.google.com/file/d/1F7k2GYF4Yf2HMTgV0OMuYca9SzC8TAIR/view](https://drive.google.com/file/d/1F7k2GYF4Yf2HMTgV0OMuYca9SzC8TAIR/view)  **DoD 5220.22-M NISP Operating Manual **– [https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/522022M.pdf?ver=2017-04-17- 134632-467](https://info.teamallegiance.com/hubfs/Pursuant_October2020/Pdf/522022M.pdf?hsLang=en)  **HIPAA Regulation Text **– [https://www.hhs.gov/sites/default/files/hipaa-simplification-201303.pdf](https://info.teamallegiance.com/hubfs/Pursuant_October2020/Pdf/hipaa-simplification-201303.pdf?hsLang=en)  **Amazon S3 Glacier **– [https://aws.amazon.com/glacier/](https://aws.amazon.com/glacier/)  ***This document is a summary of relevant points defined in the Pursuant Information Security Policy. Please refer to that document for more detailed information. ***