Security Description

Security Description of the Servers and Server Centers Used by Apprix Oy

Overview

The servers used by Apprix Oy are located in Finland, in the server center of Hetzner Online GmbH “Hetzner Data Center Park Helsinki”. 

Hetzner is one of Europe’s leading service hosting provider.

Servers

The server center is cer­tified according to the ISO / IEC 27001 standard

Physical pro­tection:

• High security server environment
• eg. video sur­veil­lance, elec­tronic access control, cooling, backup power supply.

Data network security:

• Mul­ti­level secured connections

Server security:

• Prevent denial of service (DDoS) attacks
• Firewall
  • Only care­fully selected ports open
  • IP restric­tions enabled
• Identi­fying vulnerabilities
• Intrusion pre­vention
• Anti-virus
• Pre­vention of database intrusion (including SQL injection)

Software updates:

• Auto­matic updates
• Servers cer­tified: “Common Cri­teria EAL2” 
• Defined process and roles for regular server updates

Server man­agement:

• Cent­ralized server management
• Access to the server admin­is­tration only via VPN connection
• Secure SSH/TSL con­nec­tions to servers used by des­ig­nated Apprix administrators
• Regular heartbeat-style server per­formance checks

Software Implemented by Apprix Oy

Security of data transmission

• All traffic through the web interface is encrypted (https, SHA-256).
• Encryption is also used in all other data trans­mis­sions to servers.

Data backup and recovery

• All program code is stored in version control, from where it can be restored to the latest or earlier version.
• An auto­matic backup of the database and applic­ation server is taken once a day, 
  • Storage of 7 days.
  • In addition, one monthly backup is retained.
• Copies of server disks syn­chronized by the IAAS, from which it is pos­sible to quickly start a new identical server, for example in the event of a hardware failure.
• Easy-to-implement manual backup for special situations.
• Data recovery is tested reg­u­larly on a quarterly basis.

Service port­ab­ility

• If agreed, the service can be installed (data­bases and software) on a new com­patible server

Loc­ation of service inform­ation incl. per­sonal data and transfer restrictions

• The service and its inform­ation incl. per­sonal data with con­firm­a­tions are located in Hetzner Ag’s com­puter room in Finland.
• The GDPR Dir­ective has been taken into account. 
  • Data will not be trans­ferred outside the EU at any stage of the pro­cessing, main­tenance or transfer of data in the service.

Deletion of data

• The inform­ation con­tained in the system will be deleted from the system server and backup servers when the service is terminated.

Security audit of services

• The security of the service is audited by an external pro­fes­sional body

Service Administrators, Users, Roles and Responsibilities

• The main admin­is­trator of the ser­vices is Apprix Oy’s person responsible for the service in question. 
  • The main admin­is­trator has the right to access and manage all sec­tions and data of the service. 
• Customer’s admin­is­trators have access to and control over all sec­tions and inform­ation of the service created for them.
• Admin­is­trators can grant limited, role-based access to the system itself through the system’s own access control functions. 
  • All cre­den­tials are per­sonal, shared cre­den­tials are not used.
• All systems have password-based access control for usernames.

Security – Related Agreements

Con­fid­en­ti­ality (NDA)

• A mutual oblig­ation of inform­ation con­fid­en­ti­ality is made between Apprix Oy and the customer
• Apprix has made per­sonal Non Dis­closure Agree­ments with each person (their own employees and sub­con­tractors) who handles cus­tomer data.

Data Pro­cessing Agree­ments (DPA)

• With regard to per­sonal data, the European General Data Pro­tection Reg­u­lation (GDPR) is taken into account.
• A DPA agreement has been made between Apprix Oy and Hetzner Online GmbH.
• When pro­cessing per­sonal data, sep­arate DPA agree­ments are made with customers.

Service Level Agreement (SLA)

• Service level agreement made between Apprix Oy and the cus­tomer defines the level of support (e.g. response times in various excep­tional situ­ations) and determines the SLA target levels.

Supported devices

Apprix systems are available with modern web browsers. The ser­vices support the fol­lowing browsers and versions: