Litmus Leverages Proactive Approach to Privacy to Protect Itself, Clients, & Vendors

“It was within about 18 months of GDPR having gone into effect, and at Litmus, we realized that we could react defensively against all the new regulations and benchmarks for what now constituted a solid security and privacy program, or we could actually go on offense and make this one of our strengths,” says Matt Gore, CTO and Chief Privacy Officer at Litmus. “We decided to lead with this new principal of the business, and that choice has now become a real differentiator for us in our particular market.”

Making privacy a priority required investing a lot of resources from the start, including buyin from leadership and the establishment of a specific team entrusted to support such a robust effort, as well as internal reevaluation of the growing program year after year. “As the evolution of data privacy becomes more focused on the consumer—the end user, the person who is providing the data—there needs to be an appropriate response,” explains Justin Unton, Head of Information Security and Privacy at Litmus. “End user trust is what Litmus is all about. We want to do things the right way.”

Expanding with Schellman

Given that the two organizations had already established a working relationship, it made sense for Litmus to pivot back to Schellman regarding strengthening their privacy position—especially since the assessor had well proven to be working in good faith. “In our earliest interactions with the Schellman team, we were just looking for some guidance to begin with, and I really appreciated that the fact that they did not try to sell us the most expensive service. They actually looked at what we had and offered the best fit. It created this mutual trust between our teams,” says Gore. This straightforward, honest nature established in the initial talks provided a solid foundation for the later, more complex discussions regarding the auspicious goals for the growing privacy program at Litmus.

When those discussions eventually evolved into an actual privacy assessment Litmus needed completed for a specific client, they looked to Schellman first for help. “Litmus reached out to us because they’d already seen the quality of our work, and they had another need,” says Debbie Zaller, Principal and Privacy Practice Leader at Schellman. “Since we were already their auditors elsewhere, it made the most sense to continue down this new path together.” Unton too confirms as much. “I had such a great experience the first go-around with Schellman during the SOC 2, so when I saw that they were also vendors for privacy attestations, it was a no brainer. We’d already worked with Schellman, we knew the quality of the work they produce, and so we knew what to expect going into another agreement with them.”

Privacy Particulars? No Problem with an Experienced Assessor

Not only that, but once immersed in the new process for privacy, the assessor proved itself very equipped to help. Because despite the proactive investment by Litmus into building their program, privacy remains a complicated mountain to climb in compliance, and the extra guidance provided by Schellman in navigating the particulars has made a significant difference so far. “During SOC 2, there’s this process of providing evidence—if there’s no evidence logged, it didn’t happen,” explains Unton. “With privacy, you also have to be able to prove that the actual process of providing evidence is working as it should—that you’re doing what you say you’re doing—and that presents opportunities for new controls and processes here and there.” Thankfully, Schellman fields a broadly experienced team focused entirely on privacy—their expertise helped elevate Litmus’s approach to that initial, client-specific privacy audit while also helping strengthen the overall internal knowledge of the particulars.

Outward Effects of Outside Validation

Moreover, these efforts aren’t just to assure Litmus customers that their data is safe, though that remains priority one—it’s also for the organization’s own benefit. “You have to consider the immense responsibility that consumers place on us in giving us their trust, and we take that trust very seriously,” says Gore. “It’s very helpful to have Schellman validate that trust put in us, to give that third-party perspective. Privacy is a different challenge to tackle that requires a different approach—we’re not just answering yet another security questionnaire. I think Schellman coming in to look at everything helps us all sleep better at night because there is an immense amount of responsibility to protect the people you serve well.