What are the 3rd party security testing policy and processes?

Every Sitefinity release goes through Veracode scans, including both static and dynamic code analysis. Veracode reports are not publicly available as per internal guidelines.

The entire cloud infrastructure is continuously monitored by the Sitefinity Security team. The main goal is to maintain the highest possible security level. Customers are welcome to do their own security testing as well. To help provide a high level of industry security and architecture, Progress Sitefinity Cloud complies with different regulatory standards.

In Sitefinity Cloud, the application's security is treated with highest priority. Complex mechanisms for securing your project are available on both application and infrastructure level. Check out the security documentation to learn more.