Security
Our client's' Information security has stood out as paramount importance to us.
- GET IN TOUCH
01 Certifications & Memberships
fiber_manual_record We are a member firm of Institute of Chartered Accountants in England & Wales (ICAEW)
fiber_manual_record Our operations as well as hosting environment is SSAE18 SOC I & SOC III certified
fiber_manual_record Our datacentre is ISO 27001 (Information Security Management Systems) certified
fiber_manual_record Global Data Protection Regulation (GDPR) compliant
02 Encryption of Data in Transit (Network Security)
Our Systems use the strongest encryption products to protect customer data and communications. The web interface of systems incorporate the Transport Layer Security (TLS) protocols. TLS is worldwide Web Standard for protecting critical data and is used by banks, brokerages and others to protect their client's' data.
This protocol provides data security by encrypting it as it transmitted between our application server and the browser hosted on user’s computers. During use, the lock icon in the browser, along with URL indicates that data is fully protected from access while in transit.
03 Encryption of Data at Rest (Database Security)
The Client database is only accessible through the application. Application Access to the data is highly protected and only Application credentials allow to access client's data. There is no other mean to access data without application. However, in limited circumstances access to database can be given to system development and maintenance team. Such access is always secure and minimum rights are given to them to access the data.
All sensitive information is encrypted through Two-Way encryption algorithm i.e Advanced Encryption Standard (AES) whereas login credentials like password, PIN etc are encrypted with One-Way Encryption Algorithm i.e. SHA1.
04 Data Backups
An offsite full backup of Production database is taken each day. Our database backup policy requires database backups and transaction logs to be collected so that a database can be recovered with the loss of as few committed transactions as is commercially practicable.
Database backups of systems that implement interfaces must be available as long as necessary to support the interfacing systems. This period will vary by system.
05 Disaster Recovery
Promenics has recovery time objective (RTO) of 24 hours and a recovery point objective (RPO) of maximum 24 hour. The RTO is measured from the time the Promenics Production Service becomes unavailable until it is available again. The RPO is measured from the time the first transaction is lost until the Promenics Production Service became unavailable.
06 Authentication
Administrator has the right to set up different authentication requirements for different user populations including:
fiber_manual_record Strength of Password
fiber_manual_record Password expiry period
fiber_manual_record Change password upon first login
fiber_manual_record Special character to include in password
fiber_manual_record Restrict to use previously used password until defined resets
fiber_manual_record Multifactor Authentication
fiber_manual_record System lockout policy after failed login attempts
fiber_manual_record Show last login status
fiber_manual_record Session time-out policy
07 Physical Security
Control Activities are jointly exercised by Promenics and System & Database Hosting Provider. Promenics has partnered with Rackspace (www.rackspace.com), an award-winning world's leading specialist in the hosting and cloud computing industry. Promenics manages the Systems backups, releases, upgrades and database management, and Rackspace provides the environment, security, redundant power lines and high bandwidth solution access through the internet. Rack space delivers enterprise-level hosting services around the world and serving more than 130,000 customers, including over 110,000 cloud computing customers. Rackspace data centers adhere to the strictest physical security measures:
fiber_manual_record Multiple layers of authentication are required before access is granted to the server area
fiber_manual_record Critical areas require two-factor biometric authentication
fiber_manual_record Camera surveillance systems are located at critical internal and external entry points
fiber_manual_record Security personnel monitor the data centers 24/7
fiber_manual_record Unauthorized access attempts are logged and monitored by data center security
fiber_manual_record All physical access to the data centers is highly restricted and stringently regulated
08 Authorization
Customer-configurable security groups are based on users, roles, jobs, organizations, location hierarchy, or business sites. The Promenics application enforces group policy-based security for authorization.
The application prevents any user from directly accessing the production database. Created security groups, combined with predefined security policies, grant or restrict user access to functionality, business processes, reports, and data—whether accessed online or through web services.
09 Auditing and Logging
System tracks all changes to business data at the application level. This application audit information is the basis for audit and compliance reporting found throughout the system. System records include successful & unsuccessful logins as well as any changes in information as to what changes are made and who made those changes through a specified login account.
This enables customers to obtain a complete audit trail and provide an auditor with the information required to trace the history of changes
10 Single Sign-on Support
Promenics uses SAML for SSO which takes the next step by enabling an enterprise SSO environment. SAML allows for a seamless SSO experience between the customer’s internal identity and access management (IAM) solution and Promenics Systems.
11 Access
Promenics has incorporated the concept of Role Based Access Control (RBAC) which allows System Administrator to grant permission to roles and assign roles to users. Permission include; add, update, view, delete etc. Each user is assigned one or more roles.
Only those capabilities which have been granted to the specific role are made available to users. Users that have not been assigned specific roles are not aware that other capabilities even exist in the system.
12 Data Segregation
We provide different hosting options to our client's to choose one from, including:
fiber_manual_record Dedicated Server with client only instance of application
fiber_manual_record Shared cloud with client only instance of application
fiber_manual_record Multi-tenant application, or
fiber_manual_record Client can specify their recommended structure
In normal circumstances we recommend Multi-tenant option which is secure and beneficial. Promenics System is a multi-tenant SaaS application. Multi-tenancy is a key feature of our application that enables multiple customers to share one physical instance of the Promenics system while isolating each customer tenant’s application data.
Every user ID is associated with exactly one tenant, which is then used to access the Promenics application. All instances of application objects (such as Organization and Worker) are tenant-based, so every time a new object is created, that object is also irrevocably linked to the user’s tenant. The Promenics system maintains these links automatically and restricts access to every object, based on the user ID and tenant. When a user requests data, the system automatically applies a tenancy filter to ensure that it retrieves only information corresponding to the user’s tenant.
13 Vulnerability assessments
Vulnerability assessments and penetration testing of the system are also evaluated and conducted on a regular basis by both internal Promenics resources and external third-party vendors.
