Security Policy

Employee-related security

• All workstations (laptops & desktops) of employees are encrypted using disk encryption.
• Access to various web applications accessible by employees are using single-sign-on and two-factor authentication (Google Oauth) and require a Virtual Private Network (VPN) when working remotely.
• Administrator access to the Help Desk Migration Platform Management interface is only allowed by VPN.

Personal Data

All personal data is kept using a retention period. Backup data is stored in proprietary binary format (“pseudo encrypted”) and separated per client. Graylog required for system monitoring has a retention period of 30 days max.

Data Storage

All data silos are installed and managed in our infrastructure, except for Amazon S3, located in Germany. Each data silo can only be accessed through our Virtual Private Network:

• Public network traffic uses Secure Socket Layer (SSL).
• Private network traffic is currently unencrypted; we use HTTPS termination on LB.

Data Monitoring

We closely monitor data access and transformation. Audit logs of who accessed data are in place and stored for an unlimited period. We currently only monitor our centralized data access interfaces; native clients are not monitored.

Network Security

Help Desk Migration network security team protects your data against the most sophisticated electronic attacks. We use the best and proven practices of network security.

Help Desk Migration offers the following preventive measures:

• network firewalls.
• DDoS preventions.
• network posture assessment.

Data access and authentication

Only authorized tech engineers at Help Desk Migration have access to the source code, can work on custom migrations, and solve support cases on demand of the support staff. Different engineers have different access rights depending on their job requirements. All engineers have their own credentials as well as some parts of the software can only be reached from specific IPs.

Production environment security

• Logging in to the servers is only possible by means of public/private key exchange; passwords are not used.
• The administration panel requires two-factor authentication.
• All security updates are automatically installed, and the server is always up-to-date.
• Strict firewall configuration from the public internet that only allows HTTP and HTTPS access on load balancers.
• Communications to and from the servers, as well as backups, are only performed via secured channels (SSL / HTTPS).
• SSH is only accessible by private VPN.
• There is active monitoring (gray log + alerts) and the banning of incorrect login attempts (fail2ban).
• All (virtual) servers are hosted externally.

Hosting & Infrastructure

Help Desk Migration hosts its complete infrastructure at Hetzner as of December 18, 2019. All of our (virtual) servers & services and our data storage are located within the European Union (Germany). This includes our backup copies stored in Amazon Web Services S3 (AWS), whose designated location is Germany (Frankfurt).

Our hosting provider, Hetzner Online, takes special measures that provide the physical safety of the hardware.

For instance, data center parks are protected from fire and natural disasters. Only authorized personnel can access via electronic access control terminals with a transponder key or admission card. Data parks are under 24/7 surveillance and are equipped with diesel power generators for autonomous mode.

Data Transformation

All our data processing is based on events, single small pieces of immutable data that encapsulate a unique event that occurred in the past. We use these events to construct data representations and data profiles, and since events are immutable, direct data transformation is not possible by default.

Other than correcting data belonging to a Data Subject, it is impossible to alter or correct data stored in our data silos, with the sole exclusion of Database Administrators.

Data-in-transit & Data-at-rest

Data-in-transit is defined by two categories: information that flows over the public or untrusted network such as the internet, and data that flows in the confines of a private network such as a corporate or enterprise Local Area Network (LAN). At Help Desk Migration, all data that flows through public networks is encrypted using SSL. Our private networks are heavily protected and, thus, not accessible by the public, making it not necessary to be using SSL.

Data-at-rest is data that is not actively moving from device to device or network-to-network, such as data stored on a hard drive, laptop, flash drive, or archived/stored in some other way. Data protection at rest aims to secure inactive data stored on any device or network. While data-at-rest is sometimes considered less vulnerable than data in transit, attackers often find data at rest a more valuable target than data in motion. At Help Desk Migration, all hard disks (or desktops, laptops, and servers) use disk encryption by default.