Security

Merglab takes data security and privacy very seriously, and we recognize that our security measures and practices are important to you. While we cannot expose too much detail around our practices (as it can empower the very people we are protecting ourselves against), we can provide general information to give you confidence in how we secure the data you entrust to us.

Data Center Security

• Merglab delivers VOD and Data Streaming for our users. We use multiple MTAs, placed in different world-class data centers around the United States.
• Our data centers manage physical security 24/7 with biometric scanners and the usual high tech stuff that data centers always brag about.
• We have DDOS mitigation in place at all of our data centers.
• We have a documented "in case of nuclear attack on a data center" infrastructure continuity plan.

Protection from Data Loss, Corruption

• User accounts are segregated from each other through multiple layers of logic which prevent corruption and overlap
• Merglab’s technology infrastructure includes network devices such as firewalls, and IDS/IPS tools which are strategically placed to control and monitor network traffic for data loss and corruption
• Account data is mirrored and regularly backed up off site.

Application Level Security

• Merglab account passwords are hashed. Our own staff can't even view them. If you lose your password, it can't be retrieved—it must be reset.
• All login pages (from our website and mobile website) pass data via TLS 1.2 or higher.
• The entire Merglab application is encrypted with TLS 1.2 or higher.
• Login pages and logins via the Merglab API have brute force protection.
• We provide the ability to enable email or SMS notifications about key activity.
• We provide the ability to enable two-factor (2FA) authentication to your Merglab account.
• We perform regular external and internal security penetration tests throughout the year using different vendors. The tests involve high-level server penetration tests, in-depth testing for vulnerabilities inside the application, and social engineering drills.
• The findings of our pen-testing results are kept strictly confidential. We can confirm that any findings are addressed and repaired.
• Merglab facilities have at least one staffed guard station/receptionist area on premise.

IT Security

• Our network is heavily segmented and centrally monitored.
• We have a dedicated security team that constantly monitors our environment for vulnerabilities. They perform penetration testing and social engineering exercises on our environment and our employees. Our security team includes OSCP and CISSP certified members.

Employee Security & Safeguards

• We continuously train employees on best security practices, including how to identify social engineering, phishing scams, and hackers.
• All new hires and contingent workers are required to sign Non-Disclosure and Confidentiality Agreements.
• In order to protect our company from a variety of different losses, Merglab has established a comprehensive insurance program. Coverage includes, but is not exclusive to: coverage for cyber incidents, data privacy incidents (including regulatory expenses), general error and omission liability coverage, excess cyber liability coverage, property and business interruption coverage, as well as international commercial general liability coverage.

SOC II & III Compliant and PCI DSS Certification

• Merglab's credit card processing vendor uses security measures to protect your information both during the transaction and after it is complete. Our vendor is certified as compliant with card association security initiatives, including the Visa Cardholder Information Security and Compliance (CISP), MasterCard® Site Data Protection Program (SDP), and Discovery Information Security and Compliance (DISC).
• We also perform annual SOC II & III audits. We provide our SOC reports upon request and completion of an NDA. We do not accept redlines to the NDA as it governs the confidential information specific to our SOC reports.

Safeguarding Your Account & Protecting Ourselves Against You

Yes, you heard that correctly. We can secure ourselves like Fort Knox, but if your computer gets compromised and someone gets into your Merglab account, that's not good for either of us.

• We monitor and will automatically suspend accounts for signs of irregular or suspicious login activity.
• In addition to our scalable algorithms, we employ another layer of human reviewers, who monitor for anomalous account and email activity.
• We monitor accounts and campaign activity for signs of abuse.
• Certain changes to your account, such as to your password, will trigger email notifications to the account owner.
• We provide the ability to enable email or SMS notifications about key activity.
• We provide the ability to enable two-factor (2FA) authentication to your Merglab account.
• We provide the ability to establish tiered-levels of access within accounts.

Investing in Your Privacy

• Our privacy team partners with teams across the organization to make sure our products and features comply with applicable data protection and anti-spam laws.
• We regularly review and update the legal policies that impact our relationship with you.
• We’re committed to compliance with applicable data protection laws and providing our customers with the tools to help them with their own compliance requirements.
• Information about compliance with GDPR can be found here.

Responsible disclosure program

Merglab is committed to ensuring the security of our services and customer information. As part of this commitment, we encourage security researchers to contact us to report any potential weaknesses identified in any product, system, or asset belonging to Merglab. This program isn’t intended to represent a public bug bounty program and we make no offers of reward or compensation for submitting potential issues. We appreciate your commitment to improving Merglab services.

Responsible disclosure guidelines

Security Researchers will disclose potential weaknesses in compliance with the following guidelines:

Do

• Share the security issue with us before making it public (e.g., on message boards, mailing lists, or other forums).
• Wait until we provide you notification that the vulnerability has been resolved before you disclose it to third parties. We're focused on the security of our customers and our systems, and some vulnerabilities take longer than others to address.
• Provide a clear, concise description of the steps needed to reproduce any vulnerability you submit.
• Provide the complete details related to the security issue, including proof-of-concept (POC) URL, as well as the details of the system(s) where tests have been conducted.

Don't

• Don’t cause harm to Merglab, Media415, its customers, shareholders, partners or employees.
• Don’t engage in any act that may cause an outage or stop any of Merglab’s services.
• Don’t engage in illegal activities or any acts that violate any international laws or regulations, or federal or state laws or regulations.
• Don’t store, share, compromise or destroy any Merglab data or customer data while conducting research activities. If personally identifiable information (PII) is encountered, you are required to stop and immediately notify Merglab.
• Don’t conduct fraudulent activity or complete fraudulent financial transactions as part of your research.

Out-of-scope vulnerabilities

The following types of vulnerabilities are out of scope for this program:

• Phishing
• Social engineering
• Physical security assessments
• Any form of denial of service (DoS) attack

This Security was last updated on January 25, 2024.