Data archiving and removal policy
Medallia is passionate about ensuring that our clients are able to comply with data privacy regulations, including the European Union’s GDPR, which goes into effect in May 2018. We provide our clients with enterprise-grade controls to manage, govern access and ensure security of personal data housed in Medallia Experience Cloud. As required by GDPR, Medallia allows our clients to correct, export, or permanently delete personal information associated with an individual survey taker or employee. Medallia also purges personal data from internal processing systems to minimize the data we retain per GDPR Article 5. Please visit our GDPR page to find out more how Medallia is setting the bar for CX data protection.
Data storage policy
Medallia has implemented extensive security processes for protecting access to our data
center infrastructure, all of which is Tier III, SOC 2 and/or ISO 27001 certified.
All Medallia data centers have common security practices, including closed-circuit video monitoring and 24/7-manned guards, and each requires the use of biometric access controls to our locked cages.
Medallia provides encryption for data rest residing in the Medallia Experience Cloud, as
well as various types of data in motion. The following page provides additional details
on Medallia’s data encryption capabilities.
Data center location(s)
United States, France, Canada, Germany, Singapore, Australia
Data hosting details
Cloud hosted, on a colocated data center
App/service has sub-processors
yes
Guidelines for sub-processors