Security at Alteryx
Get a detailed preview of our Information Security Programused to govern the protection of the company’s data, assets,and products.

About Us
Alteryx is a trusted partner in intelligent decisionmaking. Alteryx software empowers enterprises
worldwide with automated, AI-driven insights,
enabling data democratization across various use
cases for impactful business outcomes. With over
8,300 organizations relying on our platform, Alteryx
takes Information Security seriously.
Alteryx's Information Security Program is founded ona defense-in-depth approach, combining technology,
processes, and skilled employees serving as the firstline of defense to protect data and operations. Holding
ISO 27001 and SOC2 Type II certifications, we offer ourcustomers and stakeholders the assurance of aligningto security industry standards. Moreover, Alteryx
proudly follows respected global security frameworks
like ISO 27001, NIST Cybersecurity Framework, and CIS
Controls, reinforcing our dedication to data protection,a secure environment, and secure products.

PurposeThis document transparently shares Alteryx’s
Information Security Program, fostering a strong
and secure partnership built on reliable supportand trust. We look forward to collaborating with ourcustomers to achieve intelligent decision-making
with confidence.

2SECURITY AT ALTERYXCertifications
Alteryx’s compliance certifications provide
assurance to customers and stakeholders
that the organization has been certified
by independent third-party auditors andfollows security best practices.

policies, standards, and processes that follow
global security frameworks such as ISO
27001, NIST Cybersecurity Framework, andthe CIS Controls.

Information Security Policies
Adherence to company policies andprocedures ensures a secure and compliant

ISO 27001
Alteryx’s ISO 27001 certification
demonstrates the implementation of acomprehensive framework for managing
and protecting its information assets. It
signifies a commitment to maintaining theconfidentiality, integrity, and availability ofinformation, as well as ongoing monitoringand improvement of the Information
Security Management System (ISMS).

SOC2 Type II

environment where information is handled
responsibly and in accordance withindustry best practices. Alteryx policies
and procedures serve as a set of guidelines
and rules that employees, contractors,
and other stakeholders must adhere towhen handling information and using theorganization's IT infrastructure. Alteryx
policies are updated regularly to keep pacewith changes in regulations, technologies
and industry security best practices.
Alteryx information security policies
are made available to all personnel andAlteryx’s SOC2 Type II certification

acknowledged annually, further reinforcing

demonstrates the effective

the commitment to maintaining a secure

implementation and maintenance ofand compliant environment.

internal security controls and measures
to protect customer data, ensure
system availability, and maintain theconfidentiality and privacy of sensitive
information. Alteryx continues to update
and extend the scope of its SOC 2 Type II
audit program.

Corporate Security
At Alteryx, we are committed to upholding
the highest standards of information security.
As part of our dedication to protecting theconfidentiality, integrity, and availability of
our systems and data, we have implemented

3SECURITY AT ALTERYX

Personnel Security
Personnel are subject to backgroundchecks before employment, an important
step to ensure the security and integrityof our workforce in handling sensitive
data. Additionally, personnel are subjectto confidentiality obligations, highlighting
Alteryx’s commitment to safeguarding
customer information. By requiring
personnel to acknowledge and adhere
to Alteryx’s Information Security Policy,
Alteryx reinforces a culture of data security
and creates a workforce that prioritizes theresponsible handling of systems and data.

S E C U R I T Y AT A LT E R Y X

Security Training & AwarenessAt Alteryx, we recognize the criticalrole of our employees in bolstering ourorganization's security posture andserving as the first line of defense against
potential threats. The primary objective ofaccess control systems, security officers,alarms, and an incident response plan.
These proactive measures effectively reduce
physical risks and safeguard our employees,guests, and assets.

this program is to foster a robust security

Asset Management

culture within the organization. ThroughAlteryx has an asset management andcomprehensive and targeted role-based

governance framework to oversee its

training, Alteryx instills responsible

technology assets throughout their lifecycle,

information handling practices andensuring operations remain reliable andempowers individuals to effectively identify,secure. This includes both physical andreport, and respond to security risks.

virtual technologies, ensuring secured use,regardless of the asset's location.

Additionally, Alteryx offers role-specifictraining to engineers, focusing on criticalaspects such as secure coding, OWASPTop Ten, and Privacy by Design. By
integrating security by design principles
into our development culture, we further
reinforce the importance of security
throughout the software development
lifecycle of our products.

Physical Security

4

Business Continuity &Disaster Recovery
Alteryx’s business continuity and disasterrecovery framework assures data recovery
in the face of disruptions such as server
failures, data breaches, or natural disasters,ensuring minimal data loss and downtime.
All systems within our environment are
diligently accounted for, with documented
recovery time objective (RTO) targets andAlteryx Global Physical Security ensures theregular backups, enabling the restoration

safety of individuals, property, and assetsof critical systems and data in case of anby deploying a range of measures, including

incident. Regular efficacy testing andSECURITY AT ALTERYXthird-party auditor oversight further bolster theeffectiveness of our Disaster Recovery plan. Additionally,our updated and exercised business continuity plansoffer detailed recovery steps for applications, facilities,
vendors, and our most valued asset: our employees.

Audit Compliance
Our customers can trust in the strength of our security
practices as we actively review and uphold compliancewith security laws and regulations. Through supportinginternal and third-party assessments, we ensure that
our information security controls, processes, andsystems consistently meet defined thresholds.

Vendor Risk Management
A vendor risk assessment process supports thesecurity and reliability of our software solutions.
Prior to onboarding any third-party vendors, Alteryx
conducts risk assessments and evaluates theirsecurity practices to ensure appropriateness. Periodic
reviews and active monitoring, aligned with our risk
management program, customer commitments, andregulatory obligations, further strengthen the securityof our supply chain.

Data Retention and Destruction
Policies regarding the proper retention anddestruction of data are essential for maintaining
the highest levels of data security, compliance withregulations, and safeguarding sensitive information.
Data is retained for the period required by applicablelegal and/or contractual requirements and thendisposed of in a secure manner

5SECURITY AT ALTERYXApplication Security
Secure Software Development

Encryption

The software components of Alteryx

Encryption is a fundamental pillar of ourare developed in line with our Software

security strategy, ensuring that sensitive

Development Lifecycle (SDLC) policy. Alteryx

data remains protected. At Alteryx, we followuses a risk-based approach when applying

industry-leading encryption standards,

its SDLC methodology, which may include

prioritizing the confidentiality and integrity

performing security architecture reviews,

of information. Our encryption practices

automated security scans, and external

are regularly reviewed and updated to alignpenetration testing. Alteryx performs

with the latest security best practices. By

periodic security code reviews and scans

implementing robust encryption measures,source code as well as packaged software towe ensure data is shielded from unauthorized

monitor against malicious threats.

access, both in transit and at rest.

Product Vulnerability Management
Alteryx follows industry-standard

Identity and Access Management(IAM)

security practices to identify and resolve

IAM controls ensure that only authorized

vulnerabilities both before and after

individuals have access to sensitive data

product release to provide reliable andand critical systems, effectively reducing

secure products. Vulnerabilities go throughthe risk of unauthorized access andevaluation, rating, and prioritization. Updates

enhancing overall security.

are released to address vulnerabilities insupported versions, with cumulative fixes

Alteryx maintains internal access controls

incorporated in major and minor releases.

aligned to industry best practices. Systemaccess is reviewed and granted by the platform

Security
Architecture
Network Security

or product owners on a regular, recurring
basis. Systems are continuously monitored forevents related to authentication, user accountcreation, restricted group access, and network
device access.

Network security at Alteryx follows defense-in-

Alteryx systems require role-based access

depth methodology and enforces the principle

utilizing the principle of least privilege.

of least privilege by restricting network access

Authentication credentials are unreadable

to systems, applications, and services. Changes

during transmission and storage. Passwords

to these configurations are restricted to

are required to be complex in accordance

authorized personnel as well as monitored andwith our password policy. External access toapproved through a change management

corporate systems requires the use of theprocess. The network is continuously

Alteryx Virtual Private Network (VPN) along

monitored for health and performance, andwith Multi-Factor Authentication (MFA).

periodic access reviews take place for accounts

Automated account lockout occurs afterwith advanced permissions.

multiple failed attempts and misplaced, lost,or untrustworthy devices are wiped remotely

FIPS Capability
Alteryx Designer FIPS, is our FIPS-capable desktop
analytics solution meticulously designed to meet
Federal Information Processing Standards (FIPS)
thresholds set by the National Institute of Standards andTechnology (NIST) and in accordance with the Federal
Information Security Management Act (FISMA). This
capability is a testament to our commitment to robust
data security, ensuring a secure analytics environment.
With Alteryx Designer - FIPS, users can confidently blend
diverse data securely and efficiently, empowering
seamless data analysis within highly regulatedenvironments.

Security Operations
The purpose of Security Operations at Alteryx is toprovide protective, detective, and responsive services.
These capabilities have improved our cyber defense
capabilities enabling greater visibility, quicker
detection, and faster responsiveness.
Alteryx uses machine learning technologies to analyze
datasets, optimize detection coverage, prioritize threat
detections, automate threat hunting, and identify andenrich high-fidelity alerts and patterns that can beinvestigated by our Security Operations team.

Incident Management
The Alteryx Cybersecurity Incident Response Plan(CIRP) establishes the actions and procedures that help
the Security Operation Center (SOC) team prepare forand respond to security incidents, including how toinitiate responsive action, remediate adverseconsequences, document lessons learned; andcontinuously improve the incident response processes.
The CIRP is regularly tested using a combinationof planned reviews and live simulations along withperiodic training.

7SECURITY AT ALTERYXLog Management
Alteryx maintains awareness of security-related events
through the centralized collection and analysis of
event logs from systems, applications, physical security
assets, and services, providing a comprehensive viewof the security and performance of its production
infrastructure.

Detection & Monitoring
Alteryx leverages modern threat detection andprevention systems to safeguard and monitor against
malicious exploitation, unauthorized disclosure,modification, and destruction. These systems
are actively monitored, with potential problems
or violations documented and escalated to theappropriate teams to ensure prompt remedial action.

Endpoint Protection
Alteryx deploys controls to ensure endpoint devices
are adequately protected from potential threats.
Alteryx workstations run a suite of endpoint security
and monitoring technologies to detect suspicious
code, unsafe configurations, or anomalous user
behavior quickly and efficiently.

Enterprise Vulnerability
Management
Alteryx has a comprehensive vulnerability management
program that manages any reported or suspectedvulnerability across its lifecycle, with defined processes
that cover identification, assessment, prioritization,remediation, verification, and reporting. All risks aretriaged, with vulnerabilities addressed in line withguidance from NIST and other industry standards.

8SECURITY AT ALTERYXWe look forward to partnering with you.
Alteryx, through its award-winning Alteryx Analytics Cloud Platform,
enables organizations to deeply integrate actionable business intelligence
into decision-making processes across their organizations, from the frontline employees to C-suite executives. With our relentless focus on putting
analytics within reach of everyone while providing the tools neededfor enterprise security and governance, Alteryx empowers end users
without adding complicated, time-intensive layers of maintenance andconfiguration to already-stressed IT resources.
You can find more information about our efforts and compliancecertifications at alteryx.com/trust, and we’re here for any other questions
you have about our security program.
Welcome to the analytics movement.