Security Description

Security Description of the Servers and Server Centers Used by Apprix Oy

Overview

The servers used by Apprix Oy are located in Finland, in the server center of Hetzner Online GmbH “Hetzner Data Center Park Helsinki”. 

Hetzner is one of Europe’s leading service hosting provider.

Servers

The server center is cer­tified according to the ISO / IEC 27001 standard

Phy­sical protection:

• High security server environment
• eg. video sur­veil­lance, electronic access control, cooling, backup power supply.

Data network security:

• Mul­ti­level secured connections

Server security:

• Prevent denial of service (DDoS) attacks
• Firewall
  • Only care­fully selected ports open
  • IP restric­tions enabled
• Iden­ti­fying vulnerabilities
• Intrusion pre­vention
• Anti-virus
• Pre­vention of database intrusion (including SQL injection)

Software updates:

• Auto­matic updates
• Servers cer­tified: “Common Cri­teria EAL2” 
• Defined process and roles for regular server updates

Server mana­gement:

• Cent­ra­lized server management
• Access to the server admi­nist­ration only via VPN connection
• Secure SSH/TSL con­nec­tions to servers used by desig­nated Apprix administrators
• Regular heartbeat-style server per­for­mance checks

Software Implemented by Apprix Oy

Security of data transmission

• All traffic through the web interface is encrypted (https, SHA-256).
• Encryption is also used in all other data trans­mis­sions to servers.

Data backup and recovery

• All program code is stored in version control, from where it can be restored to the latest or earlier version.
• An auto­matic backup of the database and appli­cation server is taken once a day, 
  • Storage of 7 days.
  • In addition, one monthly backup is retained.
• Copies of server disks synchro­nized by the IAAS, from which it is pos­sible to quickly start a new iden­tical server, for example in the event of a hardware failure.
• Easy-to-implement manual backup for special situations.
• Data recovery is tested regu­larly on a quar­terly basis.

Service por­ta­bility

• If agreed, the service can be installed (data­bases and software) on a new com­pa­tible server

Location of service infor­mation incl. per­sonal data and transfer restrictions

• The service and its infor­mation incl. per­sonal data with con­fir­ma­tions are located in Hetzner Ag’s com­puter room in Finland.
• The GDPR Directive has been taken into account. 
  • Data will not be trans­ferred outside the EU at any stage of the pro­cessing, main­te­nance or transfer of data in the service.

Deletion of data

• The infor­mation con­tained in the system will be deleted from the system server and backup servers when the service is terminated.

Security audit of services

• The security of the service is audited by an external pro­fes­sional body

Service Administrators, Users, Roles and Responsibilities

• The main admi­ni­strator of the ser­vices is Apprix Oy’s person respon­sible for the service in question. 
  • The main admi­ni­strator has the right to access and manage all sec­tions and data of the service. 
• Customer’s admi­ni­strators have access to and control over all sec­tions and infor­mation of the service created for them.
• Admi­ni­strators can grant limited, role-based access to the system itself through the system’s own access control functions. 
  • All cre­den­tials are per­sonal, shared cre­den­tials are not used.
• All systems have pas­sword-based access control for usernames.

Security – Related Agreements

Con­fi­den­ti­ality (NDA)

• A mutual obli­gation of infor­mation con­fi­den­ti­ality is made between Apprix Oy and the customer
• Apprix has made per­sonal Non Disclosure Agre­e­ments with each person (their own employees and subcontractors) who handles customer data.

Data Pro­cessing Agre­e­ments (DPA)

• With regard to per­sonal data, the European General Data Pro­tection Regu­lation (GDPR) is taken into account.
• A DPA agre­ement has been made between Apprix Oy and Hetzner Online GmbH.
• When pro­cessing per­sonal data, separate DPA agre­e­ments are made with customers.

Service Level Agre­ement (SLA)

• Service level agre­ement made between Apprix Oy and the customer defines the level of support (e.g. response times in various excep­tional situ­a­tions) and deter­mines the SLA target levels.

Supported devices

Apprix systems are avai­lable with modern web browsers. The ser­vices support the following browsers and versions: