Security Overview
The most effective way to keep your data private and secure is to focus on the fundamentals, Glance has adopted the following security practices.
Do not store data unless it's needed
The surest way to keep data private is to not gather or store it in the first place. Glance only gathers and stores data if there's a clear operational need for it.
Password security
We do not store user passwords. Instead, we store password hashes. We use the industry-standard BCrypt hashing algorithm with 16-character random salts. This password security scheme makes it extremely difficult for bad actors to guess passwords from stored hashes. And, Glance enforces password-complexity rules.
Nevertheless, Glance strongly encourages you to use industry-standard Single Sign-on (SSO) mechanisms, such as SAML 2.0, to eliminate the need for Glance to store your passwords.
Cross-site scripting security
The Glance web application is built to resist attack. We use locked-down dedicated web servers and database servers, with all unnecessary features removed to reduce the attack surface. Glance has development policies and tools in place to create code that resists injection, cross-site scripting, and request-forgery attacks.
Glance uses cryptographically random (hard-to-guess) session keys with automatic expiration to resist credential-replay attacks. We store only hashed passwords, hashed according to current security best practice (Bcrypt with 16-character random salts). Each customer may select their own password-complexity standards. Glance's architectural design prohibits the downloading or uploading of any data to the session servers.
Glance uses a host-based intrusion detection system to identify suspicious behavior. Server updates and patches are applied in accordance with the severity of the issues they address both weekly and monthly. Because attack vectors are always evolving, Glance tests its application for vulnerabilities at least twice a year with the latest version of tools such as BurpSuite and ZAPScan. All vulnerabilities are repaired as they are uncovered. Security policies are endorsed by the CTO.
Information Storage
Glance Networks stores the session details from any given session. Glance only stores session metadata and does not store any data from the session itself.
Glance stores the following session metadata:
- start time
- stop time
- number of guests that join the session
- participants' Internet Protocol (IP) addresses, from which it is possible to infer geographic location.
- the Glance URL (Agent Glance Address)
- the Session Type (whether a Cobrowse or a Screen Share session)
Internal Glance Monitoring
If requested by a customer via written correspondence, an authorized Glance Super-user can join an active session for the purpose of testing or monitoring activities. Glance requires the unique session ID and the Glance user address to locate and join that session. We do not actively monitor any sessions and make it a practice to not join any session unless otherwise required by our customers.
Glance cobrowsing has the capability to escalate sessions from one-to-one to many-to-one. This enables an agent to invite another authorized agent to join the in-process Cobrowse session. Doing this means the agent may escalate the conversation from one agent to two agents and have a soft handoff with the end-customer.