Software Development (Agile/Scrum Method)

Data protection and privacy

Policies to protect data and privacy

1. We don’t use public cloud storages, in case a cloud storage is needed, we create and manage it ourselves, on our own servers.
2. Applications are only reachable through https and SSL secure encrypted connections.
3. Development, communication and management happens exclusively through the use of secured VPN connections or direct hardwired connections.
4. Because we work with freelancers and external companies, we have our own protected log-in server. Only through the use of that server our people can develop and manage our applications. Not through direct connections from their own places of work. These connections are constantly monitored, giving us complete insight on who is working on each server and when. No one is able to copy data to external machines. Production data will always remain on our servers during work.
5. Everyone working for us is contractually obligated to work by our security rules and this is constantly monitored and evaluated.
6. Internal communications are always done through our own encrypted e-mail, chat and conference servers. We do not use 3rd party servers, not even to discuss your project.
7. Server and application management alerts are send through encrypted chat groups in which only the people directly involved in developing and managing your application are included.
8. Incase it’s possible, all e-mail and chat communication with clients is over encrypted servers. However, the possibility of using this depends on the clients willingness to install encryption software on their own systems.
9. For documents we have our own encrypted cloud servers, we will never use 3rd party cloud systems (ie. Google cloud, Dropbox, etc.) to store your data, or discuss or manage your project.
10. For our agile development set up we use an internal and secure gitlab server. This is used for planning, coordinating and bugreports. This system is also used for project documentation storage.
11. Data minimalization and Data management
• We store only data that is needed for the applications to function
• As soon as Data becomes obsolete (for both our application and the clients needs) it’s removed permanently.
• Data never leaves our data centers unless in the form of management reports for the client.
• Management reports contain no unneeded (personal) information.
• All management reports are made GDPR compliant during development.
• Data is exclusively stored on our own servers.
• Data never leaves the European Union.
• Data is always encrypted when possible.
12. All our servers are placed in professional hosting centers which at least include:
• Alarmsystems with 24 hour monitoring.
• Physical access control
• Excellent security
• Dual power supplies
• Dual connections
13. All physical maintenance and repairs are executed either by, or under supervision of our own certified specialists. No 3rd party can ever touch your servers without our knowledge and supervision.
14. Damaged data carriers (ie. Hard disks etc.) are professionally destroyed, making sure no data can be recovered from any discarded hardware.
15. Static data that has to be kept for a long time, is stored on M-Disks. M-Disks (Millenial discs) are onetime writable discs with a maximum of 100GB storage capacity which are designed to last for 1000 years. These M-Disks are managed by our Disc robot. The Disc robot contains 500 M-Discs and can read and write 8 discs simultaneously.
16. Between our offices and datacenter is a private glassfiber hardline connection, which provides us with a 10GBps direct connection to our own (development) servers.

New Data security and privacy measures.

• Currently we’re implementing new modules in all our new, and most of our old applications, to give users the ability to review all data stored about them.
• We’ve implemented new firewalls in our data center which provide 2 factor identification logins.