# What data security and compliance risks should teams evaluate before adding a Marketo LaunchPoint app?

<p class="elv-tracking-normal elv-text-default elv-font-figtree elv-text-base elv-leading-base elv-font-normal" elv="true">Curious how the Marketo community reads this one. What data security and compliance risks should a team evaluate before adding a Marketo LaunchPoint app, given that every one of them gets a key to the lead database?</p><p class="elv-tracking-normal elv-text-default elv-font-figtree elv-text-base elv-leading-base elv-font-normal" elv="true">The risk isn't the app's own security page. It's what you hand over to get it working: a Marketo API user, usually with broader scopes than the app needs, pointed at a database full of personal data. Adobe's own review of an Exchange listing doesn't cover your instance. The questions I'd ask before install:</p><ul>
<li>Which API scopes does it need, and does the vendor accept a role with less?</li>
<li>Does lead data leave Marketo to the vendor's servers, or stay inside your environment?</li>
<li>Where is the vendor's data hosted, and does that meet your residency rules?</li>
<li>SOC 2 or ISO 27001, from the vendor, not from Adobe</li>
<li>Consent: does the app add new personal data, and is that covered by the consent you collected?</li>
<li>Vendor durability: how many people, and when was the app last updated on Adobe Exchange?</li>
<li>Can it be tested in a Marketo sandbox first?</li>
</ul><p class="elv-tracking-normal elv-text-default elv-font-figtree elv-text-base elv-leading-base elv-font-normal" elv="true">A few from the<a class="a a--md" elv="true" href="https://www.g2.com/categories/marketo-launchpoint-apps"> </a><a class="a a--md" elv="true" href="https://www.g2.com/categories/marketo-launchpoint-apps">Marketo LaunchPoint Apps</a> category on G2 that show how differently apps answer those:</p><ul>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/progress-software-progress-datadirect/reviews"><strong>Progress DataDirect</strong></a> (Rated 4.7/5): Drivers that run inside your own BI or data environment, so Marketo data flows to systems you already govern rather than to a third-party cloud. Trade-off: the security model is yours to maintain.</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/jeto/reviews"><strong>Jeto</strong></a> (Rated 4.7/5 on G2): Campaign data passes through Jeto's platform, but the trade is governance: standardised configurations and access control so non-admins never touch Marketo directly. Trade-off: a vendor in the data path.</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/gigya-customer-identity-management-platform/reviews"><strong>Gigya</strong></a> by SAP (Rated 3.8/5): Consent and preference management built for GDPR, with SAP's scale behind it. Trade-off: it changes where identity lives, which is a larger compliance decision than an app.</li>
<li>
<a class="a a--md" elv="true" href="https://www.g2.com/products/lead-intelligence-verify-score/reviews"><strong>Lead Intelligence: Verify &amp; Score</strong></a> by Neustar: Enrichment from third-party identity data, which means personal data entering Marketo that your consent may not cover.</li>
</ul><p class="elv-tracking-normal elv-text-default elv-font-figtree elv-text-base elv-leading-base elv-font-normal" elv="true">What's the one finding in a security review that made you drop a LaunchPoint app from your shortlist?</p><p class="elv-tracking-normal elv-text-default elv-font-figtree elv-text-base elv-leading-base elv-font-normal" elv="true"></p><p class="elv-tracking-normal elv-text-default elv-font-figtree elv-text-base elv-leading-base elv-font-normal" elv="true"></p>

##### Post Metadata
- Posted at: 10 days ago
- Author title: Tech Consultant
- Net upvotes: 1


## Comments
### Comment 1

&lt;p&gt;&lt;span style=&quot;background-color: transparent; color: rgb(0, 0, 0);&quot;&gt;Reading through the Marketo LaunchPoint Apps category on G2, the post&#39;s framing is the right one; the app&#39;s own security page tells you nothing about what you&#39;re handing over, which is API access to a database of personal data. Apps that keep processing inside your own environment, rather than pulling lead data out to a vendor&#39;s servers, shift the security question from a vendor-trust exercise to something your own team already governs, which is a meaningfully lighter compliance lift.&amp;nbsp;&lt;/span&gt;&lt;/p&gt;

##### Comment Metadata
- Posted at: 6 days ago
- Author title: Marketing



### Comment 2

&lt;p&gt;&lt;span style=&quot;background-color: transparent; color: rgb(0, 0, 0);&quot;&gt;Looking at the Live Blog category on G2 specifically for this pairing, the framing in the post, match versus crowd, is the right split, because these two tools are really solving different halves of sports coverage rather than competing head to head on the same job. Built-in scoreboards and live tickers matter enormously to a reporter at the ground who needs the score inside the blog itself, while pulled-in social posts and live chat matter to a desk editor whose job is curating what fans and players are already saying rather than filing play by play.&amp;nbsp;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;background-color: transparent; color: rgb(0, 0, 0);&quot;&gt;Offline mode is the detail that actually decides this for stadium reporting specifically, since a derby day with a packed venue and unreliable signal is exactly the condition that separates a tool built for the sideline from one built for a desk with steady connectivity. Rather than one tool beating the other, the sharper question is probably whether your coverage model needs a reporter physically filing from the ground, or an editor curating a feed from the desk, since that answers itself before the tools even come into it.&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;

##### Comment Metadata
- Posted at: 6 days ago
- Author title: Marketing





## Related discussions
- [How well does Trello scale into a larger team?](https://www.g2.com/discussions/1-how-well-does-trello-scale-into-a-larger-team)
  - Posted at: over 13 years ago
  - Comments: 6
- [Can we please add a new section](https://www.g2.com/discussions/2-can-we-please-add-a-new-section)
  - Posted at: over 13 years ago
  - Comments: 0
- [Quantifiable benefits from implementing your CRM](https://www.g2.com/discussions/quantifiable-benefits-from-implementing-your-crm)
  - Posted at: over 13 years ago
  - Comments: 4