Enterprise-Grade Security Posture
MERGE, as the provider and operator of Digesto, operates under robust, enterprise-grade security standards. Our company undergoes independent SOC 2 Type II audits and is actively in process for HITRUST compliance, supported by an accredited third-party security vendor on an annual basis. In addition, we perform comprehensive annual third-party penetration testing to ensure our infrastructure remains resilient against emerging threats. For detailed compliance updates and report availability, please visit the MERGE Trust Center
Security Overview by Plan
Growth, Publisher, & Agency Plans: Digesto does not access or store any data related to Marketo leads or lead activities. We store only program and campaign identifiers required to execute email distribution services, account configurations, and billing details.
One-to-One Personalization (BETA):Digesto accesses restricted Marketo Lead records strictly for identified blog/newsfeed subscribers. None of the processed lead data is retained after processing, and all compliance controls enforced within your Marketo instance remain fully active.
Personal Data & Billing
User & Billing Information: Collected fields are strictly limited to Company Name, First Name, Last Name, and Email Address, alongside billing details (Physical Address).
Payment Processing: Digesto never handles or stores credit card details. All financial transactions and invoicing are securely managed via Chargebee and Stripe.
Authentication & Access Control
Secure Authentication: Access to the Digesto application requires Username and strong Password credentials and is strictly enforced over encrypted HTTPS / SSL channels.
API Security & Marketo Integration: Digesto connects to your Marketo instance using secure REST API standards. Marketo administrators maintain full control to audit, rotate, or revoke API keys at any time via Marketo custom web services.
Data Storage & Encryption
Infrastructure: Databases are hosted securely on **Amazon AWS Relational Database Service (Amazon RDS)**, leveraging AWS’s world-class physical and software security infrastructure.
Backups: Automated, secure data backups occur daily and are retained securely for a 35-day window.
Encryption Standards: In Transit: All data transferred between Digesto and Marketo is encrypted using SHA-256 encryption protocols. At Rest: All sensitive information, including user credentials, authentication secrets, and personal data, is encrypted using AES-128 bit encryption prior to database storage.
Sub-Processors
The Digesto platform is built on trusted third-party technologies that process customer data in compliance with our security standards. We maintain an up-to-date List of Sub-Processors within our Software Bill of Materials (SBOM) document, which is accessible to all customers upon request. Please contact support@digesto.io to request the latest version.
Service Availability & Uptime
We maintain high availability across our infrastructure. You can view real-time system status, historical uptime metrics, and any security or service interruption reports at any time on our System Status Report Page.
User Authentication
Access to the Digesto application requires a basic authentication (username and password), and a HTTPS / SSL certificate is required for all to access the Digesto application.
Whitelisting - User Agent & IP Address
Digesto uses the following user agent when accessing RSS feeds:
Digesto/1.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0
In the event you have extra firewall/security on your server (and feed), you may need to whitelist Digesto's user agent above so as to allow Digesto to access your feed.
You can also use these fixed IP address to whitelist the Digesto server access to your RSS feed.
54.173.229.200
54.175.230.252
Access Role
Digesto is a single-user platform. When you register, an "Administrator" role is granted that allows the following actions:
Configure Marketo API Access
Create, Updated, Delete, Edit, Test, and Activate Digest.
Manage Account (contact info, email, payment method)
Manage subscription
Access Logs (Read Only)
Security Contact
If you have any concerns or questions related to MERGE security please contact our MERGE Trust Center