Litmus Leverages Proactive Approach to Privacy to Protect Itself, Clients, & Vendors

Privacy as a Priority

In 2019, Litmus brought in Schellman to discuss options for compliance assessments, and at that time, talks centered around whether a SOC 2 or an ISO 27001 certification would be more suitable. Eventually, Litmus partnered with Schellman for SOC 2 Readiness, Type 1 SOC 2, and Type 2 SOC 2 examinations before extending their relationship for recurring Type 2 examinations. Throughout their initial collaborations, the teams expanded their discussion to include notable data breaches in the news and what that meant for already complicated privacy concerns, as well as what could help bolster what was already a substantial plan in place for maintaining Litmus customer trust.

“It was within about 18 months of GDPR having gone into effect, and at Litmus, we realized that we could react defensively against all the new regulations and benchmarks for what now constituted a solid security and privacy program, or we could actually go on offense and make this one of our strengths,” says Matt Gore, CTO and Chief Privacy Officer at Litmus. “We decided to lead with this new principal of the business, and that choice has now become a real differentiator for us in our particular market.”

Making privacy a priority required investing a lot of resources from the start, including buyin from leadership and the establishment of a specific team entrusted to support such a robust effort, as well as internal reevaluation of the growing program year after year. “As the evolution of data privacy becomes more focused on the consumer—the end user, the person who is providing the data—there needs to be an appropriate response,” explains Justin Unton, Head of Information Security and Privacy at Litmus. “End user trust is what Litmus is all about. We want to do things the right way.”

Expanding with Schellman

Given that the two organizations had already established a working relationship, it made sense for Litmus to pivot back to Schellman regarding strengthening their privacy position—especially since the assessor had well proven to be working in good faith. “In our earliest interactions with the Schellman team, we were just looking for some guidance to begin with, and I really appreciated that the fact that they did not try to sell us the most expensive service. They actually looked at what we had and offered the best fit. It created this mutual trust between our teams,” says Gore. This straightforward, honest nature established in the initial talks provided a solid foundation for the later, more complex discussions regarding the auspicious goals for the growing privacy program at Litmus.

When those discussions eventually evolved into an actual privacy assessment Litmus needed completed for a specific client, they looked to Schellman first for help. “Litmus reached out to us because they’d already seen the quality of our work, and they had another need,” says Debbie Zaller, Principal and Privacy Practice Leader at Schellman. “Since we were already their auditors elsewhere, it made the most sense to continue down this new path together.” Unton too confirms as much. “I had such a great experience the first go-around with Schellman during the SOC 2, so when I saw that they were also vendors for privacy attestations, it was a no brainer. We’d already worked with Schellman, we knew the quality of the work they produce, and so we knew what to expect going into another agreement with them.”

Outward Effects of Outside Validation

Moreover, these efforts aren’t just to assure Litmus customers that their data is safe, though that remains priority one—it’s also for the organization’s own benefit. “You have to consider the immense responsibility that consumers place on us in giving us their trust, and we take that trust very seriously,” says Gore. “It’s very helpful to have Schellman validate that trust put in us, to give that third-party perspective. Privacy is a different challenge to tackle that requires a different approach—we’re not just answering yet another security questionnaire. I think Schellman coming in to look at everything helps us all sleep better at night because there is an immense amount of responsibility to protect the people you serve well.