Hosting and protection

Your own system

Every company gets its own, fully separate system: its own server, network, database, file storage, keys and web address. Nothing is shared with other customers, so a problem at another company can’t reach your data.

Where your data is

Your system runs in a data centre in the EU, by default in Germany. Your documents, users and the audit log stay there.

Closed to the outside

• From the internet, only the encrypted web address (HTTPS) of your system can be reached. The database, the file processing and all other internal parts have no public access.
• Inside the system, every part can only talk to the parts it really needs.
• Only our operations team can administer the server – with personal keys, no passwords, and only from known addresses.

Protection against attacks

• A web application firewall checks every request and blocks known attack patterns before they reach the application.
• Intrusion prevention detects addresses that behave like attackers and blocks them.
• Attempts to exploit known vulnerabilities (CVEs) are blocked as well.
• Their rules and threat information update automatically every day.
• Excessive numbers of requests are slowed down, so a single client can’t overload the system.

Encryption on the way

• All connections are encrypted with TLS 1.2 or newer. Unencrypted requests are redirected to HTTPS, and browsers are told to always use HTTPS.
• Certificates are renewed automatically.

Updates

• Security updates of the operating system are installed automatically every day.
• Every day, our systems are scanned for known vulnerabilities (CVEs). Findings are fixed with priority.
• The software and third-party components we use are kept up to date through an automated update process, and we roll the updates out to every customer system.
• The desktop app on the ship PCs updates itself.

Virus scanning

Every file uploaded is checked for viruses before it is stored. If the check isn’t possible at that moment, the upload is refused – a file is never stored unchecked.

Backups

• The database is backed up every night, encrypted, to a separate location.
• Backups are kept for 14 days, 8 weeks and 12 months, and their integrity is checked automatically every week.
• Documents are additionally kept in versioned storage, so earlier versions of a file can be recovered.

Monitoring

The system is monitored automatically. Our team is alerted when something fails – for example a service, an expiring certificate, a missing backup or outdated protection rules.