Antavo security basics

...

The Antavo Loyalty Engine uses API requests to communicate with client systems. Securing these requests is necessary to protect personal data and to prevent fraudulent behavior. HTTPS encryption and the API key and secret generated at the beginning of each program ensure that the data remains secure.
Read more about the API security protocol here.

Authentication and password management

...

• Register only with individual accounts – do not use a generic account, e.g. info@yourcompany.com.

• Do not share your password information with anyone.

• Multi-factor authentication (MFA) is highly recommended for signing in to the platform for increased security.

  • Administrator users with elevated rights can enforce the use of MFA.

Password criteria

Go to Users can change their passwords by clicking the profile icon at the bottom -left corner of the main sidebar, opening the Manage profile page, and click on your profile's icon. The navigating to the Change password tab.

The ‘Password’ field informs the user about the password policy-related criteria can be found under the Manage Profile → Change password interface. Here, besides the criteria, a password strength meter is displayed, assessing the strength of the given string.

...

(configured under the Settings menu) and displays if the entered password meets these criteria or not. Passwords that don’t meet the complexity requirements cannot be used as login credentials to the Antavo Backoffice.

...

The new password has to be re-entered in the ‘Confirm password' field to make sure no unintentional change is made.

Single sign-on

Single sign-on (SSO) lets users access all authorized network resources with one login. Usernames and passwords are validated against your corporate user database or other client apps rather than Antavo managing separate passwords for each resource. Some of Antavo’s integrations have developed use SSO authentication with Auth0 using JSON web tokens (JWT) format.

...

through the Auth0 identity management platform.

Security measures

There are a few security measures that you need to take under the Settings menu of the Antavo Backoffice.

General settings

...

• Define the password complexity rules and expiry time

...

• under the Passwords section

• Select a timezone for your loyalty program

...

Security settings

...

• under the Localization section
  Please note that the configuration of imports, exports, and workflows (including both campaigns and ‘On a date’-triggered general workflows) reflects the actual execution and is based on the UTC timezone and displayed in the Backoffice accordingly.

• Determine the session length of the brand under

...

• the Security tab

Data backup

Antavo creates a backup of all customer data. This customer service ensures 90-day retention period and 1-hour snapshotsdata based on its data backup policy . Backups are located in the same stack as production instances. Please reach out to support the Antavo Service Desk in case you have further questions or requests.

...

Security logs can be accessed by going to the General Settings page and clicking the opening the Security logs tab of the Settings menu. This page lists all login and password reset information that occurs in the specific brand.
Read here more about the details that can be accessed here.

Workflow logs

Workflow logs contain every workflow run for the given can be accessed both from the point of a specific workflow or from a specific customer. A new item is added to the log logs every time a workflow is triggered by an event or a date. The lists give information listed includes on the timestamp date (the exact date and time of the execution), time (duration of the execution), type, nodetrigger, and output (success or failure) of workflow execution.

Event logs

The personal event stream can be viewed under the Customer insights page. This includes every event that has occurred to a customerbeen registered on the customer’s event history, along with its type, date, and properties.
Read more about customer events in the Activity log descriptionthe customer event history here.

Approval logs

Content Approval records are approval history is available and exportable for auditing in .cvs and .psv formats from the History page of the Content approval module.

Webhook logs

The Webhook module’s Log page of the Webhooks (legacy), Webhooks, and Incoming Webhook modules shows the list of events to keep track of webhook triggered messages. The Summary

• The Webhooks (legacy) and Webhooks log page lists the time, action, customer, response status with code

...

• , as well as a detailed breakdown for every webhook, which includes the header and messages.
  Third-party tools PostBin can be used to display outbound webhook messages.
  The webhook log also has the possibility of resending a webhook event, in case there was an error.

• The Incoming Webhook log page lists the date and time of the registration of the webhook message, the detailed request with the endpoint it was sent to, the processing time, and the response status with code.

Access management

User role

...

permissions

Antavo enables the creation of new Backoffice users with distinct roles, each with configurable access levels to the platform. In some cases, some users may need access (see, edit, and delete the value) to a particular object but need restrictions on individual fields.

User groups

The User groups module allows the controlling of endrecord-user record level access of Backoffice users. Setting up user groups simplifies the process of aligning users, organizational structures, and roles.

Customer mapping

Creating customer mapping rules allows to batch-update various attributes of customers, based on their previously set grouping. This helps in organizing the customers to separate compartments in the Backoffice without the use of importing.