CloudGuard Code Security Data Sheet

CHECK POINT

CloudGuard Code

Security Data Sheet

This Privacy Data Sheet explains how Check Point’s CloudGuard Code Security processes personal data.

About CloudGuard Code Security

CloudGuard Code Security performs scans on source code, detecting misconfigurations. It features customizable on-prem scanner enhanced by machine learning. CloudGuard Code Security enables developers to code securely by providing alerts on any secrets or misconfigurations, and offers a comprehensive visualization of the codebase along with detailed alerts, reports, and analytics.

How does Check Point comply with applicable data protection regulations?

At Check Point, ensuring customer privacy and security remains our foremost concern, with the trust our customers place in our services being one of our most valued assets.

1. Security. As a leading AI-powered, cloud-delivered cyber security platform provider over the past decades, we acknowledge the significance of implementing rigorous security measures to safeguard our customers’ information. For more details, visit our Information Security Measures Policy.

2. Privacy by Design. We operate under the principle of privacy by design. This means that we prioritize the protection of personal data and privacy throughout the entire lifecycle of our products and services. We treat personal data with the utmost care. Our commitment to privacy is reflected in our policies, procedures, and the way we do business. For more details, visit our Privacy Policy and our Trust Point.

3. Disaster Recovery. We maintain comprehensive plans and procedures for disaster recovery and business continuity.

4. Transfers. In order to regulate the transfer of personal data between the Check Point entities, Check Point has adopted an intercompany agreement for transfers of data between its various Check Point entities, including the EU Standard Contractual Clauses and UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Check Point’s US subsidiary, Check Point Software Technologies, Inc. (and its subsidiaries) has self-certified its compliance with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework (DPF).

What Types of Personal Data does CloudGuard Code Security Process?

CloudGuard Code Security may process personal information extracted from:

• Code security application RBAC (Role-Based Access Control) – Names, email addresses, job titles, and roles of individuals granted access to the application or specific features, as well as information related to user activity, such as login timestamps, IP addresses, and user IDs, which could be linked to individuals.
• Alerts: (i) User-specific Data: Alerts may contain information about the individual or account associated with specific security incidents, including email addresses or user IDs; (ii) Incident Details: If an alert is triggered by a user's action or misconfiguration, it could include user-specific metadata or any identifying information related to that incident.
• Licensing information: Data associated with the organization's contact person for licensing, including names, business email addresses, and phone numbers

Why does CloudGuard Code Security Process Data?

CloudGuard Code Security processes data to achieve several key security goals for your codebase:

• Vulnerability Detection: It analyzes your code to identify potential vulnerabilities that attackers could exploit. This helps preventing breaches and data leaks.
• Secret Detection: It scans for sensitive information like passwords, API keys, and other credentials that might be accidentally embedded in your code. This prevents unauthorized access to your systems.
• Misconfiguration Detection: It checks infrastructure as code (IaC) templates for security misconfigurations that could leave your cloud environment vulnerable.

By processing this data, CloudGuard Code Security assists you in creating secure applications and infrastructure right from the start, reducing the likelihood of security issues in the future.

What is the Frequency of Processing?

Data is shared with CloudGuard Code Security throughout the subscription term.

What is the Retention Period?

Data will be retained for the duration of the subscription term, along with an extra 90 days to enable customers to retrieve their data if desired.

Where is Personal Information Stored?

Personal information is stored on AWS Cloud Hosting Service. The hosting locations available are: United States, Europe, Australia, India, Canada, and Singapore. The location is selected per customer's choice during the onboarding process.

Sub-Processors

Check Point engages third-party Sub-processors in connection with the provision of the Check Point’s products and services. The list of Sub-processors is available at our Sub-Processors Page.

Privacy options

For instance, Cloud Guard Code Security enables users to customize their scanner settings to decide the extent of data shared with Check Point servers. This includes an option to run the scanner solely on-premises without transferring any data to Check Point or to selectively send metadata to Check Point for more advanced security analysis.

Authorized access to personal data

Customer Access

Access to data is controlled by Customer’s system administrator. Only users authorized by the administrator can access data. Every access and action by administrators and authorized users are fully logged.

Check Point Access

Data contained within the customer’s CloudGuard Code Security may be accessed by Check Point’s support and R&D teams for troubleshooting and security purposes. Such access is granted only to those authorized representatives for which the access is necessary to perform their intended functions.

Disclaimers

Information contained in this data sheet is for awareness only, may be modified, and does not constitute legal or professional advice or warranty of fitness for a particular purpose.

This Privacy Data Sheet is a supplement to Check Point’s Privacy Policy. Please visit it for more information on how Check Point collects and uses personal data.